search

sherlock-audit / 2023-05-USSD-judging

9 stars 7 forks source link

simon135 - If `token1=Dai` the rebalance mostly wont work with high USSD value #942

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

simon135

high

If token1=Dai the rebalance mostly wont work with high USSD value

Summary

When token1=daiThe price will be divided by 1e14 /1e12 which for almost any value in dai it will return 0 and cause wrong calculations and wrong rebalancing and possible reverts if dai is more than USSD.

Vulnerability Detail

Mostly like if the price is `9000e18/8000e6` which dai to USSD then we do the sqrt math on it and it becomes 
2.
sqrtPriceX96 = sqrt(9000e18/8000e6) * 2**96=8.40341564622e34;
3.
price =(sqrtPriceX96 * sqrtPriceX96) * (1e18) >> (96 *2) // which is / 2**96
price=8.91316828285e58;
4.
(1e24/price)/1e12= which turns price into 0 because 1e24 is smaller then e58 value

Impact

rebalance will revert or cause an undesired state by not getting the real price and instead getting zero

Code Snippet

     price = uint(sqrtPriceX96)*(uint(sqrtPriceX96))*(1e18 /* 1e12 + 1e6 decimal representation */) >> (96 * 2);
        // flip the fraction
        price = (1e24 / price) / 1e12;

poc


    function test_math_again() public {
        uint am=8e58;
        uint s=1e24;
        uint amount = uint(1e24/am) /1e12;
        require(amount==0);
    }

Tool used

Manual Review

Recommendation

if 0 make it revert and change the math to am/1e24

Duplicate of #222