This repository has been archived by the owner on May 26, 2024. It is now read-only.
xiaoming90 - Different spot prices used during the comparison #85
Labels
High
A valid High severity issue
Reward
A payout will be made for this issue
Sponsor Confirmed
The sponsor acknowledged this issue is valid
Will Fix
The sponsor confirmed this issue will be fixed
xiaoming90
high
Different spot prices used during the comparison
Summary
The spot prices used during the comparison are different, which might result in the trade proceeding even if the pool is manipulated, leading to a loss of assets.
Vulnerability Detail
https://github.com/sherlock-audit/2023-10-notional/blob/main/leveraged-vaults/contracts/vaults/BalancerComposableAuraVault.sol#L90
Line 91 above calls the
SPOT_PRICE.getComposableSpotPrices
function to fetch the spot prices. Within the function, it relies on theStableMath._calcSpotPrice
function to compute the spot price. Per the comments of this function,spot price of token Y in token X
andspot price Y/X
means that the Y (base) / X (quote). Thus, secondary (base) / primary (quote).https://github.com/sherlock-audit/2023-10-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/math/StableMath.sol#L90
The above spot price will be used within the
_calculateLPTokenValue
function to compare with the oracle price to detect any potential pool manipulation. However, the oracle price returned is in primary (base) / secondary (quote) format. As such, the comparison between the spot price (secondary-base/primary-quote) and oracle price (primary-base/secondary-quote) will be incorrect.https://github.com/sherlock-audit/2023-10-notional/blob/main/leveraged-vaults/contracts/vaults/common/SingleSidedLPVaultBase.sol#L355
Impact
If the spot price is incorrect, it might potentially fail to detect the pool has been manipulated or result in unintended reverts due to false positives. In the worst-case scenario, the trade proceeds to execute against the manipulated pool, leading to a loss of assets.
Code Snippet
https://github.com/sherlock-audit/2023-10-notional/blob/main/leveraged-vaults/contracts/vaults/BalancerComposableAuraVault.sol#L90
https://github.com/sherlock-audit/2023-10-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/math/StableMath.sol#L90
https://github.com/sherlock-audit/2023-10-notional/blob/main/leveraged-vaults/contracts/vaults/common/SingleSidedLPVaultBase.sol#L355
Tool used
Manual Review
Recommendation
Consider verifying if the comment of the
StableMath._calcSpotPrice
function is aligned with its implementation with the Balancer team.In addition, the
StableMath._calcSpotPrice
function is no longer used or found within the current version of Balancer's composable pool. Thus, there is no guarantee that the math within theStableMath._calcSpotPrice
works with the current implementation. It is recommended to use the existing method in the current Composable Pool's StableMath, such as_calcOutGivenIn
(ensure the fee is excluded) to compute the spot price.The text was updated successfully, but these errors were encountered: