Closed sherlock-admin closed 1 year ago
ni8mare
medium
slot0
Using slot0 to calculate the token price can be easily manipulated.
The function getOwnValuation() in USSDRebalancer uses slot0 to calculate price:
getOwnValuation()
USSDRebalancer
function getOwnValuation() public view returns (uint256 price) { (uint160 sqrtPriceX96,,,,,,) = uniPool.slot0(); if(uniPool.token0() == USSD) { price = uint(sqrtPriceX96)*(uint(sqrtPriceX96))/(1e6) >> (96 * 2); } else { price = uint(sqrtPriceX96)*(uint(sqrtPriceX96))*(1e18 /* 1e12 + 1e6 decimal representation */) >> (96 * 2); // flip the fraction price = (1e24 / price) / 1e12; } }
But, slot0 returns the most recent data point and hence can be easily manipulated. Please check a similar issue which was reported here.
The function getOwnValuation is again used in the SellUSSDBuyCollateral() and rebalance() and hence these functions could be manipulated as well.
getOwnValuation
SellUSSDBuyCollateral()
rebalance()
https://github.com/USSDofficial/ussd-contracts/blob/f44c726371f3152634bcf0a3e630802e39dec49c/contracts/USSDRebalancer.sol#L72
Manual Review
To determine the price, use a TWAP instead of slot0 of uniswapV3pool.
Duplicate of #451
ni8mare
medium
Using
slot0
to calculate prices can be manipulated.Summary
Using
slot0
to calculate the token price can be easily manipulated.Vulnerability Detail
The function
getOwnValuation()
inUSSDRebalancer
usesslot0
to calculate price:But,
slot0
returns the most recent data point and hence can be easily manipulated. Please check a similar issue which was reported here.Impact
The function
getOwnValuation
is again used in theSellUSSDBuyCollateral()
andrebalance()
and hence these functions could be manipulated as well.Code Snippet
https://github.com/USSDofficial/ussd-contracts/blob/f44c726371f3152634bcf0a3e630802e39dec49c/contracts/USSDRebalancer.sol#L72
Tool used
Manual Review
Recommendation
To determine the price, use a TWAP instead of
slot0
of uniswapV3pool.Duplicate of #451