Price manipulation by sending Ether

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L479

Vulnerability details

Price manipulation by sending Ether (not profitable although)

The function Pair.price() uses Pair._baseTokenReserves uses address(this).balance or ERC20(baseToken).balanceOf(address(this)). In case address(this).balance is used (when address(0) is passed), there can be price manipulation, since it is not possible to always control the amount of ether the contract has (someone could send ether to the contract by calling selfdestruct(addr) - increasing the price of the base token. Although, It is not profitable for the user to do that, the contract is still vulnerable to prices manipulation.

Proof of Concept

Pair.sol#L479

Recommended Mitigation Steps

One state variable could be used to track the eth balance instead. Using address(this).balance should be avoided when directly linked to price setup.

[iFrostizz]

No in-scope contracts are relying on the price(). Additionally, we could send tokens to the pair in order to manipulate the price but it would be the same for an attacker to add liquidity.

[Shungy]

Duplicate #506

[c4-judge]

berndartmueller marked the issue as duplicate of #353

[berndartmueller]

Applying a partial credit as the submission only focuses on ETH-dominated pairs (and rather low quality), even though the issues also exist for baseToken (contrary to the report #383)

[c4-judge]

berndartmueller marked the issue as partial-50

[C4-Staff]

CloudEllie marked the issue as duplicate of #383