UniswapV3 slot0 should not be used to get price as it can be manipulated.

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2024-05-predy/blob/2fb1e0ec7a52fc06c2e9c8e561bccba84302e4bb/src/libraries/UniHelper.sol#L14
https://github.com/code-423n4/2024-05-predy/blob/2fb1e0ec7a52fc06c2e9c8e561bccba84302e4bb/src/PredyPool.sol#L346

Vulnerability details

Impact

UniswapV3 slot0 should not be used to get price as it can be manipulated

Vulnerability Details

The use of slot0 to obtain sqrtPrice is heavily discouraged as it is easy to manipulate as it represents the current price rather a time weighted price. An attacker can therefore use flash loans to shift the slot0 by doing large swaps on Uniswap.

Proof of Concept

slot0 is used to obtain sqrtPrice as seen below.

UniHelper.sol#L14

function getSqrtPrice(address uniswapPoolAddress) internal view returns (uint160 sqrtPrice) {
        (sqrtPrice,,,,,,) = IUniswapV3Pool(uniswapPoolAddress).slot0();
    }

PredyPool.sol#L346

function getSqrtPrice(uint256 pairId) external view returns (uint160) {
        return UniHelper.convertSqrtPrice(
            UniHelper.getSqrtPrice(globalData.pairs[pairId].sqrtAssetStatus.uniswapPool),
            globalData.pairs[pairId].isQuoteZero
        );
    }

References:
code-423n4/2024-04-panoptic-findings#537

Tools Used

Manual review

Recommended Mitigation Steps

The protocol should consider using the TWAP price.

Assessed type

Uniswap