Revert Lend - MSaptarshi's results

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Oracle.sol#L363

Vulnerability details

Impact

Usage of slot0 is extremely easy to manipulate

Proof of Concept

Protocol is using slot0 to calculate tokenPrice in their codebase, slot0 is the most recent data point and is therefore extremely easy to manipulate.

     uint160 sqrtPriceX96;
        // if twap seconds set to 0 just use pool price
        if (twapSeconds == 0) {
            (sqrtPriceX96,,,,,,) = pool.slot0();

Tools Used

Manual Review

Recommended Mitigation Steps

completely use a TWAP of higher time interval instead of slot0. since smaller time interval can be prone to flashLoan attacks , whereas higher interval is only prone to inaccurate prices , but since the protocol is also using ChainLink so it might not be much problem.

Assessed type

Uniswap