This repository has been archived by the owner on Mar 3, 2024. It is now read-only.
xiaoming90 - Inflated price due to unnecessary precision scaling #600
Labels
Has Duplicates
A valid issue with 1+ other issues describing the same vulnerability
High
A valid High severity issue
Reward
A payout will be made for this issue
Sponsor Confirmed
The sponsor acknowledged this issue is valid
xiaoming90
high
Inflated price due to unnecessary precision scaling
Summary
The price returned by the stat calculators will be excessively inflated, which could lead to multiple implications that lead to losses to the protocol.
Vulnerability Detail
The
price
at Line 137 below is denominated in 18 decimals as thegetPriceInEth
function always returns the price in 18 decimals precision.There is no need to scale the accumulated price by 1e18.
existing._initAcc
) to be inflated significantlyAssume that throughout the initialization process, the
getPriceInEth(XYZ)
always returns 2 ETH (2e18). After 18 rounds (INIT_SAMPLE_COUNT == 18
) of initialization,existing._initAcc
will equal 36 ETH (36e18). As such, theaveragePrice
will be as follows:existing.fastFilterPrice
andexisting.slowFilterPrice
will be set to2e36
at Lines 157 and 158 below.In the post-init phase, the
getPriceInEth
function return 3 ETH (3e18). Thus, the following code will be executed at Line 144s and 155 below:As shown above, the existing filter prices are significantly inflated by the scale of 1e18, which results in the prices being extremely skewed.
Using the formula of fast filter, the final fast filter price computed will be as follows:
The token is supposed only to be worth around 3 ETH. However, the fast filter price wrongly determine that it is worth around 1340000000000000000 ETH
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/stats/calculators/IncentivePricingStats.sol#L125
Impact
The price returned by the stat calculators will be excessively inflated. The purpose of the stats/calculators contracts is to store, augment, and clean data relevant to the LMPs. When the solver proposes a rebalance, the strategy uses the stats contracts to calculate a composite return (score) for the proposed destinations. Using that composite return, it determines if the swap is beneficial for the vault.
If a stat calculator provides incorrect and inflated pricing, it can cause multiple implications that lead to losses to the protocol, such as false signals allowing the unprofitable rebalance to be executed.
Code Snippet
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/stats/calculators/IncentivePricingStats.sol#L125
Tool used
Manual Review
Recommendation
Remove the 1e18 scaling.
The text was updated successfully, but these errors were encountered: