Closed sherlock-admin closed 7 months ago
1 comment(s) were left on this issue during the judging contest.
auditsea commented:
In the beginning, it's guaranteed that token price is $1
1 comment(s) were left on this issue during the judging contest.
auditsea commented:
In the beginning, it's guaranteed that token price is $1
Krace
high
Users could mint and redeem Ubiquity Dollar with a more favorable Dollar price
Summary
Upon establishing a new MetaPool, the Ubiquity Dollar's price is configured to 1 ether. In the event that users execute either the
mintDollar
orredeemDollar
functions within the same block as thesetPool
operation, they have the opportunity to leverage the 1 ether price for potential profits.Vulnerability Detail
In the provided code snippet, the function
setPool
is utilized to set a newMetaPool
by the owner. And, it establishes the price of Ubiquity Dollar to the default value of 1 ether.Let's examine the logic of price updates within the
update()
function. It's essential to note that the price is eligible for an update only whenblockTimestamp > ts.pricesBlockTimestampLast
.Hence, should an attacker execute the
mintDollar
immediately after the establishment of a new MetaPool (within the same block and timestamp), the Ubiquity Dollar's price will promptly revert to 1 ether.In the event that 1 ether happens to represent a lower price and exceeds the
mintPriceThreshold
, the attacker stands to obtain more collateral than intended. This scenario also holds true for theredeemDollar
function when 1 ether exceeds the current price.Impact
Users could mint and redeem Ubiquity Dollar with a more favorable Dollar price and profit from that.
Code Snippet
https://github.com/sherlock-audit/2023-12-ubiquity/blob/d9c39e8dfd5601e7e8db2e4b3390e7d8dff42a8e/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibTWAPOracle.sol#L31-L59 https://github.com/sherlock-audit/2023-12-ubiquity/blob/d9c39e8dfd5601e7e8db2e4b3390e7d8dff42a8e/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibTWAPOracle.sol#L68-L102 https://github.com/sherlock-audit/2023-12-ubiquity/blob/d9c39e8dfd5601e7e8db2e4b3390e7d8dff42a8e/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibUbiquityPool.sol#L326-L349
Tool used
Manual Review
Recommendation
It's recommended to set the
price0Average
andprice1Average
to the correct value when setting new Pool.Duplicate of #20