Canto Dex Oracle contest - cccz's results

Lines of code

https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L487-L508

Vulnerability details

Impact

In the getUnderlyingPrice function, the price of some ctokens is determined based on their symbols rather than their addresses. This means that when there are tokens with the same symbol as cCANTO, cNOTE, cUSDT, cUSDC, they will have the same price. And if the token symbols of cCANTO, cNOTE, cUSDT, cUSDC are updated (like adding version numbers), getUnderlyingPrice will no longer work.

Proof of Concept

https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L487-L508

Tools Used

None

Recommended Mitigation Steps

Consider storing the addresses of these tokens and determining the price based on the addresses.