`getYearnPrice` of VMEXOracle.sol is vulnerable to flashLoan attack

[hats-bug-reporter[bot]]

Github username: -- Submission hash (on-chain): 0x1205903146dbf337279ca88ecf2e6533a7b9946e73a842e27275b5d32355276a Severity: high severity

Description:

Description

Following function calculates the pricePerShare being called in out getYearnPrice, but there is inherent problem with that it does it calculations like following:

def pricePerShare() -> uint256:
    """
    @notice Gives the price for a single Vault share.
    @dev See dev note on withdraw.
    @return The value of a single share.
    """
    return self._shareValue(10 ** self.decimals)

Price per share function calls another internal function called _sharevalue() which does it calculation based upon the total supply of lp, which can be easily manipulated using the flashloan attack, leading to the draining of the vmex protocol causing loss of funds for the protocol and its users.

def _shareValue(shares: uint256) -> uint256:
    # Returns price = 1:1 if vault is empty
    if self.totalSupply == 0:
        return shares

    # Determines the current value of shares.
    # NOTE: if sqrt(Vault.totalAssets()) >>> 1e39, this could potentially revert

    return (
        shares

self._freeFunds()/ self.totalSupply)

Check the above code for yourself in the yearn finance's curve iron bank vault at the following link:

https://etherscan.io/address/0xa8E0c42F45C877e611C76F2D4bF57476f2014381#code

Code Snippet

https://github.com/VMEX-finance/vmex/blob/bbb2bb36a58e8b2da2cfc1e546c5371f754c9aac/packages/contracts/contracts/protocol/oracles/VMEXOracle.sol#L368-L377

Recommendation

use uniswap twap price or chainLink oracle

[mel0ndev]

hi, I'm from the VMEX team, do you have a tg or discord where we can discuss this further?

[Nabeel-javaid]

hi, I'm from the VMEX team, do you have a tg or discord where we can discuss this further?

A potential flash loan attack scenario and see how an attacker could manipulate the totalSupply value to influence the calculated price in the getPricePerFullShare() function.

Initial State:

totalSupply = 1,000,000 LP tokens balance = 1,000 ETH (or equivalent value of underlying assets) Flash Loan Execution:

The attacker initiates a flash loan to borrow a large amount of LP tokens, let's say 1,000,000 tokens. The flash loan is executed in a single transaction. Manipulation:

The attacker artificially inflates the totalSupply value by adding the borrowed tokens to the existing supply. Now, the updated totalSupply becomes 2,000,000 tokens. Calculation in getPricePerFullShare():

After the manipulation, the getPricePerFullShare() function is called. The calculation becomes: balance 1e18 / totalSupply = 1,000 ETH 1e18 / 2,000,000 = 500 ETH per share. Profit:

The attacker exploits the manipulated price of 500 ETH per share and performs various actions within the system, such as selling tokens or performing arbitrage. Loan Repayment:

At the end of the transaction, the attacker repays the flash loan along with any associated fees, ensuring that the total borrowed amount is returned.