Canto Dex Oracle contest - cryptphi's results

Lines of code

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-core.sol#L271-L289 https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-core.sol#L261

Vulnerability details

Impact

In BaseV1Pair contract, when calling sampleSupply(), a zero value for window argument , it will always return empty fixed sized array.

When window argument is 0, the for loop will be bypassed and sampleSupply() will return _totalSupply which is an empty array of n-points number of empty arrays.

Proof of Concept

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-core.sol#L271-L289

1. Call BaseV1Pair.sampleSupply() with inputs: points - 5 window - 0
2. _totalSupply is now an array of fixed size 5.
3. assume observations.length is 6.
4. Then calculation of i will be: i = 5 - 0 = 5
5. Since 5 is not less than 5, for loop is bypassed
6. _totalSupply which is still list of empty arrays is returned.
7. Additionally, this will also affect the result of totalSupplyAvg() and return 0 always

Tools Used

Manual review

Recommended Mitigation Steps

A require check for zero value may be necessary to resolve this.