Revert Lend - kodyvim's results

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/V3Oracle.sol#L346 https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/automators/Automator.sol#L187

Vulnerability details

Impact

If tickCumulatives[1] - tickCumulatives[0] is negative and ((tickCumulatives[1] - tickCumulatives[0]) % twapSeconds != 0, then returned tick will be bigger than it should be.

Proof of Concept

In V3Oracle contract, function _getReferencePoolPriceX96() is used by protocol to get average price.

The problem is that in case if tickCumulatives[1] - tickCumulatives[0] is negative, then timeWeightedTick should be rounded down like Uniswap library

As result, in case if tickCumulatives[1] - tickCumulatives[0] is negative and (tickCumulatives[1] - tickCumulatives[0]) % twapSeconds != 0, tick will be bigger then it should be. Which opens possibility for arbitrage opportunities.

Other instance of same issue: https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/automators/Automator.sol#L187

Tools Used

Manual Review

Recommended Mitigation Steps

Tick should be rounded down in this case:

    int24 tick = int24((tickCumulatives[0] - tickCumulatives[1]) / int56(uint56(twapSeconds)));
 +  if ((tickCumulatives[1] - tickCumulatives[0]) < 0 && ((tickCumulatives[1] - tickCumulatives[0]) % twapSeconds != 0)) tick--;

Assessed type

Context