search

primitivefinance / DFMM

Smart contracts of the DFMM protocol
https://www.primitive.xyz/blog/dfmm_protocol
19 stars 9 forks source link

tests for update #23

Open Alexangelj opened 8 months ago

Alexangelj commented 8 months ago

https://github.com/primitivefinance/DFMM/blob/e64e222fe036d92a77e8b3fabbdd7c00dc007734/src/LogNormal/LogNormal.sol#L250-L280

This function is externally exposed in the core dfmm contract update() which can be called by anyone. I'm pretty sure it is possible to update the pool to a state that would require the arbitrageur to deposit funds into the pool (+ both sides), which they would not be incentivized to do. This would lead to a pool that does not get arbitraged after update. But, I'm not sure. We should work on some dedicated tests for this to figure it out, and get the insights on this behavior from the sim

clemlak commented 8 months ago

I'm not entirely sure about the scenario you're describing. We've already identified a few potential "attacks" using update though, such as "flash updates" that could take the form of two updates in a row, sandwiching the transactions of the liquidity providers or arbitragers to abuse them. However this attack is only possible if the pool controller is malicious.