search

gnosis / dex-services

Off-chain services for the Gnosis Protocol v1.
33 stars 9 forks source link

Price Estimates should be capped at one batch #1458

Open nlordell opened 4 years ago

nlordell commented 4 years ago

From @fedgiac in #1451

I wonder if this PR can be used for a new attack on the price estimator. What if a fake token was created with a very good order that can be used to bridge between two real tokens, but which can only be filled with a small amount at every step? Something like this:

Tokens:              OWL    FT        DAI
Buy->sell amounts:   10  -> MAX128
                            MAX128 -> 100
Balances:            0      MAX256    10^(18+6)

The price between DAI and USDC is theoretically great, 10 DAI per OWL, but at most 100 wei of DAI can be sold at every batch at that price. To use this trick to manipulate the price you'd need a very large amount of DAI, but for more illiquid tokens it might be doable.

nlordell commented 4 years ago

On the other hand, if my trade resolves in 2 batches, I would find that acceptable :stuck_out_tongue: