TWAP period could be very low and potentially allow an attacker to influence this

Summary

secondsAgo could be 10 seconds, a low figure that might be influenced by an attacker.

Vulnerability Detail

The protocol implements a functionality that is used to prevent outdated prices received by users. However, in the function, it is used as a secondsAgo value for calculating which in turn is used to get a price from.

The same secondsAgo is allowed to be as low as 10 seconds which is a very low value and could be influenced by an attacker


/// @notice Return USD price of given token, multiplied by 10**18.
    /// @param token The vault token to get the price of.
    /// @return price USD price of token in 18 decimals.
    function getPrice(address token) external view override returns (uint256) {
        // Maximum cap of timeGap is 2 days(172,800), safe to convert
        uint32 secondsAgo = timeGaps[token].toUint32();
        if (secondsAgo == 0) revert Errors.NO_MEAN(token);

        address stablePool = stablePools[token];
        if (stablePool == address(0)) revert Errors.NO_STABLEPOOL(token);

        address poolToken0 = IUniswapV3Pool(stablePool).token0();
        address poolToken1 = IUniswapV3Pool(stablePool).token1();
        address stablecoin = poolToken0 == token ? poolToken1 : poolToken0; // get stable token address

        uint8 stableDecimals = IERC20Metadata(stablecoin).decimals();
        uint8 tokenDecimals = IERC20Metadata(token).decimals();

        (int24 arithmeticMeanTick, ) = UniV3WrappedLibMockup.consult(
            stablePool,
            secondsAgo
        );// @audit only check prvided for secondsAgo is that its not == 0?
        uint256 quoteTokenAmountForStable = UniV3WrappedLibMockup
            .getQuoteAtTick(
                arithmeticMeanTick,
                uint256(10 ** tokenDecimals).toUint128(),
                token,
                stablecoin
            );

        return
            (quoteTokenAmountForStable * base.getPrice(stablecoin)) /
            10 ** stableDecimals;
    }
}

Impact

This may lead to wrong assumptions on the implementation of the protocol, and the wrong price being returned by the oracle.

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/96eb1829571dc46e1a387985bd56989702c5e1dc/blueberry-core/contracts/oracle/UniswapV3AdapterOracle.sol#L57-L90

Tool used

Manual Review

Recommendation

This might seem to simple but introducing a minimum duration for secondsAgo could fix this

sherlock-audit / 2023-04-blueberry-judging

Bauchibred - TWAP period could be very low and potentially allow an attacker to influence this #85