slot0
is used in two function which could easily be manipulated
#30
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
duplicate-537
partial-25
Incomplete articulation of vulnerability; eligible for partial credit only (25%)
🤖_30_group
AI based duplicate group recommendation
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticPool.sol#L333-L344
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/PanopticFactory.sol#L328-L411
Vulnerability details
Impact
The returned parameter
currentSqrtPriceX96
fromslot0
can be easily manipulated with a flashloan, resulting in a loss of funds.Proof of Concept
The first function that calls
slot0
and uses the returned price is assertPriceWithinBounds inPanopticPool.sol
:One of the comments for this function states that it can be used in a multicall, as a slippage check, for a force exercise or liquidation. If a malicious user were to front-run the call to this function with a flashloan, they could bump up the price so that their options aren't exercised or their account isn't liquidated.
The second function that utilizes slot0 is _mintFullRange in
PanopticFactory.sol
:A malicious user could manipulate the price so that the newly created
SFPM
is deployed with more liquidity than intended.Tools Used
Manual Review
Recommended Mitigation Steps
I suggest refactoring the functions, in order for them to use Uniswap's TWAP, as it's the safer choice.
Assessed type
Oracle
The text was updated successfully, but these errors were encountered: