search

code-423n4 / 2024-05-predy-validation

0 stars 0 forks source link

Usage of slot0 is extremely easy to manipulate #653

Closed c4-bot-2 closed 4 months ago

c4-bot-2 commented 4 months ago

Lines of code

https://github.com/code-423n4/2024-05-predy/blob/main/src/libraries/UniHelper.sol#L13

Vulnerability details

Impact

Usage of slot0 is extremely easy to manipulate

Proof of Concept

  function getSqrtPrice(address uniswapPoolAddress) internal view returns (uint160 sqrtPrice) {
        (sqrtPrice,,,,,,) = IUniswapV3Pool(uniswapPoolAddress).slot0();
    }

https://github.com/code-423n4/2024-05-predy/blob/main/src/libraries/UniHelper.sol#L13

This price is used in trade to perform multiple actions throughout the codebase

It is reasonable to think that protocol will use on chain price for some tokens due to unavailability of pricefeed with better deviation threshold and heartbeat.In such cases slot0 price will be used in calculation which can be manipulated by attacker

Tools Used

Manual

Recommended Mitigation Steps

  1. To make any calculation use a TWAP instead of slot0
  2. Then compare the price from chainlink or anoother oracle to make sure that price is not stale or outdated

Assessed type

Library