The use of slot0 to obtain sqrtPriceX96Existing and sqrtPriceX96 is heavily discouraged as it is easy to manipulate as it represents the current price rather a time weighted price. An attacker can therefore use flash loans to shift the slot0 by doing large swaps on Uniswap.
Impact
UniswapV3 slot0 should not be used in _initUniV3PoolIfNecessary and launch function in the ILOManager.sol contract as it can be manipulated.
Proof of Concept
slot0 is used to obtain sqrtPriceX96Existing and sqrtPriceX96 as seen below.
Lines of code
https://github.com/code-423n4/2024-06-vultisig/blob/main/src/ILOManager.sol#L115 https://github.com/code-423n4/2024-06-vultisig/blob/main/src/ILOManager.sol#L189
Vulnerability details
The use of slot0 to obtain
sqrtPriceX96Existing
andsqrtPriceX96
is heavily discouraged as it is easy to manipulate as it represents the current price rather a time weighted price. An attacker can therefore use flash loans to shift the slot0 by doing large swaps on Uniswap.Impact
UniswapV3 slot0 should not be used in
_initUniV3PoolIfNecessary
andlaunch
function in theILOManager.sol
contract as it can be manipulated.Proof of Concept
slot0 is used to obtain
sqrtPriceX96Existing
andsqrtPriceX96
as seen below.ILOManager.sol#L115
ILOManager.sol#L189
References : RealWagmi , Maia DAO Ecosystem
Tools Used
Manual review.
Recommended Mitigation Steps
The protocol should consider using the TWAP price.
Assessed type
Uniswap