Connext Amarok contest - cmichel's results

Oracle price from DEX can be manipulated

Lines of code

https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/helpers/ConnextPriceOracle.sol#L99

Vulnerability details

Impact

The ConnextPriceOracle.getPriceFromDex function divides the balances of the two token pairs to compute the price. There are several issues with it:

1. This only returns the spot price which can easily be manipulated through flash loans. This is okay if the price oracle contract is only used off-chain
2. It only works with specific AMMs like Uniswap that keep both balances in the contract. Also, any fees that are in the contract are used as part of the price computation but they should not.
3. It uses the balance instead of the reserve data. For many Uniswap-like AMMs, the balance can be manipulated by sending tokens directly to the contract, and then reclaimed later through a skim. The reserve should be used instead.

POC

• Attacker sends a large amount of base tokens to a Uniswap V2 pool.
• The getPriceFromDex computes the token price as baseBalance denominated in token / tokenBalance. As the baseBalance is increased, the tokenPrice is increased as well.
• Attacker calls skim on the pool to get back their balance.

Recommended Mitigation Steps

The price from DEX function is not suited for any on-chain queries. For off-chain queries it can also be manipulated as it uses balance instead of reserves - which can be claimed back at a future block although this comes with risk.