Good Entry - Satyam_Sharma's results

Lines of code

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/GeVault.sol#L374

Vulnerability details

poolMatchesOracle() is used in many function under GeVault to get the price directly from Uniswap v3 pool:

 /// @notice Checks that the pool price isn't manipulated
  function poolMatchesOracle() public view returns (bool matches){
    (uint160 sqrtPriceX96,,,,,,) = uniswapPool.slot0();
    
    uint decimals0 = token0.decimals();
    uint decimals1 = token1.decimals();
    uint priceX8 = 10**decimals0;
    // Overflow if dont scale down the sqrtPrice before div 2*192
    priceX8 = priceX8 * uint(sqrtPriceX96 / 2 ** 12) ** 2 * 1e8 / 2**168;
    priceX8 = priceX8 / 10**decimals1;
  }

   https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/GeVault.sol#L366C2-L378C4

The issue is that calculation of priceX8 is likely to overflow. sqrtPriceX96 has 96 bits for decimals, 10**decimals1 will have 60 bits when decimals is 18, therefore there can be very small bits for non-decimal part of sqrtPriceX96.

Recommended Mitigation: Consider converting the sqrtPrice to a 60x18 format and performing arithmetic operations using the PRBMathUD60x18 library.

Assessed type

Decimal