Open c4-bot-2 opened 6 months ago
Intended behavior, disputed
141345 marked the issue as primary issue
141345 marked the issue as sufficient quality report
rounding error could accumlate in MagicLpAggregator
0xCalibur (sponsor) disputed
thereksfour marked the issue as satisfactory
thereksfour marked the issue as selected for report
Lines of code
https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/oracles/aggregators/MagicLpAggregator.sol#L37
Vulnerability details
Description
MagicLpAggregator is used to price LP tokens for "closely-tied" underlying tokens. It calculates the price below:
The code takes the minimal answer between the underlying oracles and considers all reserves to be worth that amount:
return int256(minAnswer * (baseReserve + quoteReserve) / pair.totalSupply());
The issue is that any difference in price between the assets represents an easy arbitrage opportunity. Suppose we have tokens (A,B), where real oracle shows:
The Pool has 1000000 LP tokens and contains:
The LP value would calculate as:
0.99 * 2000000 / 1000000 = $1.98
The actual value is:(0.99 * 1000000 + 1 * 1000000) / 1000000 = $1.99
Suppose a platform trades LPs using the aggregator pricing. An attacker could:
The delta comes at the expense of LP holders whose position gets minimized.
Impact
Loss of value due to arbitrage of any platform using MagicLpAggregator pricing.
Tools Used
Manual audit
Recommended Mitigation Steps
Always calculate the value based on the real underlying token value multiplied by amount.
Consider creating two separate oracles for lower-bound and upper-bound results. Then a lending protocol could indeed use the lower-bound for determining collateral value.
Assessed type
MEV