Closed c4-bot-1 closed 5 months ago
0xRobocop marked the issue as duplicate of #158
OpenCoreCH marked the issue as satisfactory
Hi @OpenCoreCH, thanks for the review. I think this issue is not duplicated to #93 but #84:
remove_liquidity
. This issue is about withdraw_protocol_liquidity
slippage for the admin, which is the same issue as 84.remove_liquidity
, withdraw_protocol_liquidity
lacks the ensure_price
check (check the "Proof of Concept"), which is the same root cause pointed out in this issue (check the "Recommended Mitigation Steps").safe_withdrawal
parameter, this is not the root cause (ensure_price
). And the set_asset_tradable_state
doesn't check if the current spot price is far from the oracle price (vulnerable to front-run, #174), so using ensure_price
directly would be better..According to 1 and 2, I believe this issue is duplicated to #84.
OpenCoreCH marked the issue as not a duplicate
OpenCoreCH marked the issue as duplicate of #84
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/pallets/omnipool/src/lib.rs#L1468
Vulnerability details
Impact
When the authority calls
withdraw_protocol_liquidity
to remove protocol liquidity, it's vulnerable to sandwich attacks.Proof of Concept
In
withdraw_protocol_liquidity
, we didn't make sure the spot price was not too far from the EMA oracle price. Which can lead to:withdraw_protocol_liquidity
.buy
orsell
, making the spot price and EMA price diff bigger than the max allowed one.Tools Used
Manual Review.
Recommended Mitigation Steps
Like
remote_liquidity
, we should ensure spot/oracle price diff is not bigger than the max allowed one:Assessed type
MEV