Closed sherlock-admin2 closed 2 months ago
2 comment(s) were left on this issue during the judging contest.
WildSniper commented:
borderLine medium low
WildSniper commented:
seems like optimizing the protocol other than a valid bug and taking into consideration how the main position is two sided not one sided
0xShoonya
medium
twap()
will show incorrect price for negative ticks cause it doesn't round up for negative ticksSummary
The twap() function in StrategyPassiveManagerVelodrome.sol incorrectly calculates the price for negative ticks, failing to round down as needed. This miscalculation can lead to price manipulation and arbitrage opportunities. To fix this, adjust the function to round down negative ticks correctly.
Vulnerability Detail
twap()
function inStrategyPassiveManagerVelodrome.sol
is based on the uniswap'sOracleLibrary.sol::consult()
function. It usesIVeloPool(pool).observe
to gettickCumul
array which is then used to calculateint56 twapTick
.The problem is that in case if
int56(tickCuml[1] - tickCuml[0])
is negative, then the tick should be rounded down as it's done in the uniswap library.Impact
As a result, in case if
int56(tickCuml[1] - tickCuml[0])
is negative and(tickCuml[1] - tickCuml[0]) % secondsAgo != 0
, then returned tick will be bigger then it should be, which opens possibility for some price manipulations and arbitrage opportunities.Code Snippet
https://github.com/sherlock-audit/2024-05-beefy-cowcentrated-liquidity-manager/blob/42ef5f0eac1bc954e888cf5bfb85cbf24c08ec76/cowcentrated-contracts/contracts/strategies/velodrome/StrategyPassiveManagerVelodrome.sol#L741-L748
Tool used
Manual Review
Recommendation
Add these lines in the
twap()
functionDuplicate of #95