Closed c4-bot-8 closed 4 months ago
Picodes marked the issue as duplicate of #562
Picodes marked the issue as unsatisfactory: Insufficient proof
There are slippage limits in place to prevent pool manipulation
Picodes marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/SemiFungiblePositionManager.sol#L787-L845
Vulnerability details
Summary
In the SFPM.sol the swapInAMM function is triggered when the position minted/burned in ITM, and the tokens need to be swapped (because user receive only one token). However the problem is that during the swap calculation the (uint160 sqrtPriceX96, , , , , , ) = _univ3pool.slot0(); is used. Since the sqrtPriceX96 is easily manipulated by the MEV bots / Flashloans the user funds could be lost due to manipulation.
Vulnerability details
Let's desing the flow of the attack.
The exact problem here is that during the swap the (uint160 sqrtPriceX96, , , , , , ) = _univ3pool.slot0(); is taken which could cause the swap to not work as intended.
int256 net0 = itm0 - PanopticMath.convert1to0(itm1, sqrtPriceX96); And we can see that the convert1to0 basically does this --> return Math.mulDiv(amount, 2 192, uint256(sqrtPriceX96) 2);
As we can see here, the malicious user could inflate the sqrtPriceX96, thus the prices will be calculated not correctly and user will suffer from the incorrect conversions.
Tools Used
Manual Review
Recommended Mitigation Steps
Since it is a well know vulnerability that is was previosly found many times, i suggest to use the TWAP prices instead: https://solodit.xyz/issues/h-02-use-of-slot0-to-get-sqrtpricelimitx96-can-lead-to-price-manipulation-code4rena-maia-dao-ecosystem-maia-dao-ecosystem-git
Assessed type
Uniswap