Canto Dex Oracle contest - Jeiwan's results

Lines of code

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L582

Vulnerability details

Impact

Token 0 TVL can be lower than it in fact is due to loss of precision when calculating it. This will make the LP token price lower than it actually is.

Proof of Concept

Solidity supports only integer division: when dividing two numbers the result is truncated, e.g.:

10.9999999999 ether / 1 ether = 10 ether

When calculating token0TVL:

uint token0TVL = assetReserves[i] * (prices[i] / decimals);

A price gets divided by decimals before being multiplied by an asset reserves. The division will result in a truncated number, which will make the result of the multiplication smaller.

Tools Used

Recommended Mitigation Steps

Consider ordering multiplication before division:

uint token0TVL = (assetReserves[i] * prices[i]) / decimals;

Lines of code

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L491 https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L498 https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L501 https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L505

Vulnerability details

Impact

Malicious actors can deploy fake tokens with one of the hard coded token symbols. The getUnderlyingPrice function will return the price of the original token when a fake token is passed as the parameter.

Proof of Concept

Since symbols don't unique identify tokens (a token can have any symbol, including one belonging to an existing token), there's possibility that a fake token with one of the symbols checked in the getUnderlyingPrice function is deployed. The function getUnderlyingPrice will then return a price of the real token when a fake token is provided.

Exploit scenario

Someone deploys a fake token with symbol "cCANTO". A protocol that's integrated with Canto (or Canto itself) calls getUnderlyingPrice to get the price of the fake token. The price of the real cCANTO is returned instead, which allows a malicious actor to use the fake token as a collateral or in another market operation.

Tools Used

Recommended Mitigation Steps

Consider using token addresses to identify tokens. As an example, this is how a similar function is implemented in the UniswapV2 Anchored View used by Compound:

• https://github.com/compound-finance/open-oracle/blob/d0a0d0301bff08457d9dfc5861080d3124d079cd/contracts/Uniswap/UniswapAnchoredView.sol#L124
• https://github.com/compound-finance/open-oracle/blob/d0a0d0301bff08457d9dfc5861080d3124d079cd/contracts/Uniswap/UniswapConfig.sol#L697

[Q01] Unused assignment

Targets:

• https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L492

Description

Due to the early return in the next line, the assignment to underlying is not used.