sherlock-audit / 2023-04-splits-judging

4 stars 1 forks source link

Cryptor - _getquoteAmount may not return the correct quote due to differences in tick size #63

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

Cryptor

medium

_getquoteAmount may not return the correct quote due to differences in tick size

Summary

The function _getquoteamount may not return the correct quote due to difference in tick sizes in pools.

Vulnerability Detail

The function _getquoteamount calls the UniswapV3factory to get the pool by entering the 2 tokens and the fee ($defaultFee) shown here.

https://github.com/sherlock-audit/2023-04-splits/blob/main/splits-oracle/src/UniV3OracleImpl.sol#L269

These parameters are then used to call getQuoteAtTick.

https://github.com/sherlock-audit/2023-04-splits/blob/main/splits-oracle/src/UniV3OracleImpl.sol#L277-L282

Defaultfee is an arbitrary function that can be set by the owner shown here:

https://github.com/sherlock-audit/2023-04-splits/blob/main/splits-oracle/src/UniV3OracleImpl.sol#L149-L152

However a UniswapV3 pool tick size differs depending on the fee. So there is a chance that the function will not return the correct quote for token pairs. Here is an except from their whitepaper

image

As well as the docs

"Due to the nature of the v3 smart contracts, tick spacing is directly correlated to the swap fee. Lower fee tiers allow closer potentially active ticks, and higher fees allow a relatively wider spacing of potential active ticks."

https://docs.uniswap.org/concepts/protocol/concentrated-liquidity

Impact

_getquoteamount may not return the best quote for token pair

Code Snippet

https://github.com/sherlock-audit/2023-04-splits/blob/main/splits-oracle/src/UniV3OracleImpl.sol#L269

https://github.com/sherlock-audit/2023-04-splits/blob/main/splits-oracle/src/UniV3OracleImpl.sol#L149-L152

Tool used

Manual Review

Recommendation

Can't really think of a fix for this