Canto Dex Oracle contest - hansfriese's results

Lines of code

https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L582

Vulnerability details

Impact

During the token0TVL calculation, it divides by decimals without multiplying 1e18 first.

So there might be division loss and the price might be calculated wrongly.

Proof of Concept

When we calculate this part, it divides first without multiplying 1e18.

File: 2022-09-canto\src\Swap\BaseV1-periphery.sol
582:             uint token0TVL = assetReserves[i] * (prices[i] / decimals);

Tools Used

Solidity Visual Developer of VSCode

Recommended Mitigation Steps

First, we can modify this part like below.

uint token0TVL = assetReserves[i] * prices[i] * 1e18 / decimals;
uint token1TVL = unitReserves[i] * 1e18; // price of the unit asset is always 1
LpPricesCumulative += (token0TVL + token1TVL) / supply[i];

Btw for the token0TVL calculation, I am not so sure there won't be any uint overflow and I think we can modify like below for safety.

uint token0TVL;

if(1e18 >= decimals) {
    uint diff = 1e18 / decimals;
    token0TVL = assetReserves[i] * prices[i] * diff;
}
else {
    uint diff = decimals / 1e18;
    token0TVL = assetReserves[i] * prices[i] / diff;
}   

uint token1TVL = unitReserves[i] * 1e18; // price of the unit asset is always 1
LpPricesCumulative += (token0TVL + token1TVL) / supply[i];

Low Risk Issues

Wrong comment

30 minutes should be changed to periodSize because it can be changed by admin.

• https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-core.sol#L147

Non-critical Issues

Constants should be defined rather than using magic numbers

We can define constants like `DEFAULT_POINT = 8, DEFAULT_WINDOW = 1'

• https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L532
• https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L544
• https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L561-L576
• https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L581
• https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L586

Typo

Change an to a.

• https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L511
• https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L514