search

sherlock-audit / 2024-02-leverage-contracts-judging

1 stars 0 forks source link

crypticdefense - `slot0` can be easily manipulated #6

Closed sherlock-admin2 closed 8 months ago

sherlock-admin2 commented 8 months ago

crypticdefense

medium

slot0 can be easily manipulated

Summary

slot0 is being used to calculate sensitive information which can be easily manipulated.

Vulnerability Detail

slot0 is used in two instances to calculate sqrtPriceX96, which is the current square root price in X96 representation. An attacker can take advantage of this through use of flash loans to sandwich attack users.

Impact

User is sandwiched (frontrunned),

Code Snippet

https://github.com/sherlock-audit/2024-02-leverage-contracts/blob/main/wagmi-leverage/contracts/LightQuoterV3.sol#L207-L208

https://github.com/sherlock-audit/2024-02-leverage-contracts/blob/main/wagmi-leverage/contracts/abstract/LiquidityManager.sol#L345

Tool used

Manual Review

Recommendation

Use UniswapV3 TWAP or Chainlink Price Oracle.

Duplicate of #1

fann95 commented 8 months ago

all functions control the minimum amount of output...there is no point in controlling this for each swap