Panoptic - lsaudit's results

Lines of code

https://github.com/code-423n4/2023-11-panoptic/blob/f75d07c345fd795f907385868c39bafcd6a56624/contracts/libraries/PanopticMath.sol#L149 https://github.com/code-423n4/2023-11-panoptic/blob/f75d07c345fd795f907385868c39bafcd6a56624/contracts/libraries/PanopticMath.sol#L172

Vulnerability details

Impact

The if/else condition is incorrectly implemented in convert0to1() and convert1to0().

sqrtPriceX96 should be compared against type(uint128).max, while it's compared against 340275971719517849884101479065584693834 value.

Proof of Concept

File: PanopticMath.sol

if (sqrtPriceX96 < 340275971719517849884101479065584693834) {

File: PanopticMath.sol

if (sqrtPriceX96 < 340275971719517849884101479065584693834) {

Given a sqrtPriceX96 and a token amount, convert0to1() and convert1to0() return the amount of token received in exchange.

When we examine those functions closely, we can spot, that there are basically forked from Uniswap getQuoteAtTick():

https://github.com/Uniswap/v3-periphery/blob/main/contracts/libraries/OracleLibrary.sol#L49-L69

  if (sqrtRatioX96 <= type(uint128).max) {
            uint256 ratioX192 = uint256(sqrtRatioX96) * sqrtRatioX96;
            quoteAmount = baseToken < quoteToken
                ? FullMath.mulDiv(ratioX192, baseAmount, 1 << 192)
                : FullMath.mulDiv(1 << 192, baseAmount, ratioX192);
        } else {
            uint256 ratioX128 = FullMath.mulDiv(sqrtRatioX96, sqrtRatioX96, 1 << 64);
            quoteAmount = baseToken < quoteToken
                ? FullMath.mulDiv(ratioX128, baseAmount, 1 << 128)
                : FullMath.mulDiv(1 << 128, baseAmount, ratioX128);
        }

The Uniswap sets the sqrtRatioX96 boundary to sqrtRatioX96 <= type(uint128).max, while the current implementation to sqrtPriceX96 < 340275971719517849884101479065584693834. This discrepancy will lead to a different calculations and may cause a fund loss.

Tools Used

Manual code review

Recommended Mitigation Steps

Change if (sqrtPriceX96 < 340275971719517849884101479065584693834) to if (sqrtRatioX96 <= type(uint128).max) {

Assessed type

Math