c4-bot-3 commented 4 months ago

Lines of code

Vulnerability details

C4 Issue

M-18: Users cannot stop loss in AutoRange and AutoExit

Issue Details

The AutoRange.sol and AutoExit.sol contracts allow position owners to delegate their NFTs to revert controlled bots that will managed them based on different criteria:

AutoRange.sol - rebalances liquidity positions when the token price moves out of the configured range
AutoExit.sol - automatically removes a position when it reaches a certain tick

Both of those contracts allow optional swaps to be executed in order to provide better value management for the positions. For each swap the contracts cross-verify with the pool's TWAP oracle to prevent potential price manipulation.

Problem was that even if the user configured a position NOT to use swaps, the swap price validation was still conducted. This would mean that in case the pool price goes outside the acceptable ranges, the execute() function will revert because of the swap price check. As a result the position transformation will be DOSed even though it is configured not to execute any swaps.

Mitigation

PR-12 successfully mitigates the original issue by introducing additional checks inside AutoExit.sol & AutoRange.sol that make sure the pool price validation is executed only if the position is configured for swaps

Conclusion

Mitigation Confirmed

c4-judge commented 4 months ago

jhsagd76 marked the issue as satisfactory