Closed sherlock-admin closed 1 year ago
qpzm
medium
XOracle
XOracle update is vulnerable to sandwich attack.
When a oracle update tx is in the mempool, MEV bots can buy the token that will be more expensive and sell after the price is updated.
xOracle.putPrice(_usdt, t1, 1e18); // USD1 = 1 USDT unitas.swap(_usdt, _usd1, ISwapFunctions.AmountType.Out. 10000); // Buy 10000 USD1 with 10000 USDT xOracle.putPrice(_usdt, t2, 2e18); // USD1 = 2 USDT i.e. USD1 price increases unitas.swap(_usd1, _usdt, ISwapFunctions.AmountType.In, 10000); // Sell 10000 USD1 and earn 20000 USDT
Unitas reserves are drained.
Manual Review
It is hard to eliminate sandwich attack, but it can be mitigated by the following ways.
Duplicate of #67
qpzm
medium
XOracle
update is vulnerable to sandwich attack.Summary
XOracle
update is vulnerable to sandwich attack.Vulnerability Detail
When a oracle update tx is in the mempool, MEV bots can buy the token that will be more expensive and sell after the price is updated.
Impact
Unitas reserves are drained.
Code Snippet
Tool used
Manual Review
Recommendation
It is hard to eliminate sandwich attack, but it can be mitigated by the following ways.
Duplicate of #67