Trader Joe v2 contest - philogy's results

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/79f25d48b907f9d0379dd803fc2abc9c5f57db93/src/LBPair.sol#L452 https://github.com/code-423n4/2022-10-traderjoe/blob/79f25d48b907f9d0379dd803fc2abc9c5f57db93/src/LBPair.sol#L453

Vulnerability details

Impact

The LBPair contract's flashLoan method allows borrowers to borrow funds in an atomic flashloan. The borrowed tokens must be returned along with a fee. This fee is however only distributed to liquidity providers of the currently active price range in the pair also referred to as "bin", that is despite the borrower being able to use funds deposited for other bins. Depending on the liquidity in the active bin a borrower could also atomically move the price to a price range in which they're the only liquidity provider to achieve a very low practical borrowing cost.

Proof of Concept

1. Initiate flashloan
2. Repay flashloan with fee
3. Compare accrued fees for accounts providing liquidity in the active vs. not active bins via pendingFees.

Tools Used

Manual review.

Recommended Mitigation Steps

Add global fee accumulator for tokens X and Y track fees accruing globally to all liquidity providers of a given pool. In the flashLoan method update the global accumulator rather than the bin specific accumulator to ensure that the fee is fairly shared across all liquidity providers proportional to their contribution.