Mimo DeFi contest - broccolirob's results

Lines of code

https://github.com/code-423n4/2022-04-mimo/blob/main/core/contracts/oracles/BalancerV2LPOracle.sol#L126-L129 https://github.com/code-423n4/2022-04-mimo/blob/main/core/contracts/oracles/GUniLPOracle.sol#L45-L51

Vulnerability details

Impact

The GUniLPOracle.constructor and BalancerV2LPOracle._getNormalizedBalance both assume an asset will never have more than 18 decimals. However, there is no enforced limit for decimals on ERC20 tokens or Chainlink price feed assets. For example, the “Synthetix Aggregator Debt Ratio” feed returns 27 decimals, and the “YAMv2” token has 24 decimals. Adding tokens with more than 18 decimals will cause an underflow that wraps to ~255 which will dramatically overstate the balance of such tokens and feeds.

Proof of Concept

A token similar to YAMv2 is added to Chainlink and a Mimo BalancerV2LPOracle is created for it. Now calls to getAssetPrice() are now broken and dramatically overstating or understating an asset's price relative to EUR.

Tools Used

Manual analysis.

Recommended Mitigation Steps

Trigger a revert if decimals are greater than 18.