Tapioca DAO - 0xSmartContract's results

Lines of code

https://github.com/Tapioca-DAO/tapioca-periph-audit/blob/main/contracts/oracle/implementations/GLPOracle.sol#L24-L44

Vulnerability details

The Uniswap V3 documentation states that its oracles are not suitable for Optimism because on that chain block.timestamp refers to the L1's timestamp, and thus the oracle is much less costly to manipulate. https://docs.uniswap.org/concepts/protocol/oracle#oracles-integrations-on-layer-2-rollups

Price information is obtained from Uniswapv3 TWAP in GLPOracle.sol contract

tapioca-periph-audit/contracts/oracle/implementations/GLPOracle.sol:
  23      /// @inheritdoc IOracle
  24:     function get(
  25:         bytes calldata
  26:     ) public view override returns (bool success, uint256 rate) {
  27:         return (true, _get());
  28:     }
  29: 
  30:     // Check the last exchange rate without any state changes
  31:     /// @inheritdoc IOracle
  32:     function peek(
  33:         bytes calldata
  34:     ) public view override returns (bool success, uint256 rate) {
  35:         return (true, _get());
  36:     }
  37: 
  38:     // Check the current spot exchange rate without any state changes
  39:     /// @inheritdoc IOracle
  40:     function peekSpot(
  41:         bytes calldata data
  42:     ) external view override returns (uint256 rate) {
  43:         (, rate) = peek(data);
  44:     }
  45: 

Project oracle has contracts reading oracle rates from both UniswapV3 and Chainlink from just UniswapV3 or from just Chainlink.

https://docs.tapioca.xyz/tapioca/core-technologies/pearlayer-and-oracles#price-feeds-oracles

Price Feeds (Oracles)
Tapioca leverages a combination of Chainlink and Uniswap V3 TWAP (Time Weighted Average Price) 
oracles with a 10-minute time window. 
Whenever there is a need for an oracle value, the protocol chooses between the output of Uniswap 
V3 TWAP and Chainlink Price Feed which is most at the advantage of the protocol.
For assets that do not have either a Uniswap V3 TWAP Oracle or Chainlink Price Feed, such as 
GMX GLP or Curve TriCrypto, the assets respectives protocol's price feed itself will be utilized.

Recommended Mitigation Steps

Consider using only Chainlink oracles on these L2s. Dont use Uniswap TWAP v3

Assessed type

Oracle

Lines of code

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/markets/bigBang/BigBang.sol#L365-L370 https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/markets/bigBang/BigBang.sol#L404-L408 https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/markets/bigBang/BigBang.sol#L618

Vulnerability details

The BigBang contract does not allow users to submit a deadline for their actions which execute swaps . This missing feature enables pending transactions to be maliciously executed at a later point.

A slippage check is in place, the only viable attack scenario seems to be stealing of positive slippage by MEV bots;

tapioca-bar-audit/contracts/markets/bigBang/BigBang.sol:
  336:     function buyCollateral(
  337:         address from,
  338:         uint256 borrowAmount,
  339:         uint256 supplyAmount,
  340:         uint256 minAmountOut,
  341:         ISwapper swapper,
  342:         bytes calldata dexData
  343:     ) external notPaused solvent(from) returns (uint256 amountOut) {
                // codes...

  364:         uint256 collateralShare;
  365:         (amountOut, collateralShare) = swapper.swap(
  366:             swapData,
  367:             minAmountOut,
  368:             from,
  369:             dexData
  370:         );
  
                // codes...
  375:     }


tapioca-bar-audit/contracts/markets/bigBang/BigBang.sol:
  384:     function sellCollateral(
  385:         address from,
  386:         uint256 share,
  387:         uint256 minAmountOut,
  388:         ISwapper swapper,
  389:         bytes calldata dexData
  390:     ) external notPaused solvent(from) returns (uint256 amountOut) {

              // codes...
  403:         uint256 shareOut;
  404:         (amountOut, shareOut) = swapper.swap(
  405:             swapData,
  406:             minAmountOut,
  407:             from,
  408:             dexData
  409:         );
              // codes...
  424:     }

PoC

Omitted in this case, since the exploit is solely based on the fact that there is no limit on how long a transaction including a swap is allowed to be pending, which can be clearly seen when looking at the mentioned functions.

Recommended mitigation

Introduce a deadline parameter to all functions which potentially perform a swap on the user's behalf.

Assessed type

MEV