Abracadabra Mimswap - 0xAadi's results

Lines of code

https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/oracles/aggregators/MagicLpAggregator.sol#L34

Vulnerability details

The MagicLpAggregator contract contains a flaw within the _getReserves function where it fails to return the reserve values fetched from the pair contract. This oversight results in the latestAnswer function always returning zero, which can have severe implications for any systems that depend on this contract for accurate liquidity pool pricing data.

Impact

The missing return statement in the _getReserves function leads to the latestAnswer function always returning zero. This affects any dependent systems or contracts that rely on accurate price data from the MagicLpAggregator contract, as they will receive incorrect information, potentially leading to financial loss or system failure.

Proof of Concept

The _getReserves function in the provided code snippet does not return the fetched reserves:

33:    function _getReserves() internal view virtual returns (uint256, uint256) {
34:        (uint256 baseReserve, uint256 quoteReserve) = pair.getReserves();
35:    }

https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/oracles/aggregators/MagicLpAggregator.sol#L33C5-L35C6

Due to the missing return statement, the latestAnswer function uses uninitialized variables for baseReserve and quoteReserve, which default to zero:

function latestAnswer() public view override returns (int256) {
    // ...
    (uint256 baseReserve, uint256 quoteReserve) = _getReserves();
    baseReserve = baseReserve * (10 ** (WAD - baseDecimals)); // baseReserve defaults to 0
    quoteReserve = quoteReserve * (10 ** (WAD - quoteDecimals)); // quoteReserve defaults to 0
    // ...
}

https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/oracles/aggregators/MagicLpAggregator.sol#L42C1-L44C69

Tools Used

Manual Review

Recommended Mitigation Steps

Update _getReserves()

-    function _getReserves() internal view virtual returns (uint256, uint256) {
+    function _getReserves() internal view virtual returns (uint256 baseReserve, uint256 quoteReserve) {
-        (uint256 baseReserve, uint256 quoteReserve) = pair.getReserves();
+        (baseReserve, quoteReserve) = pair.getReserves();
     }

Assessed type

Other