Tapioca DAO - pks_'s results

Lines of code

https://github.com/Tapioca-DAO/tapioca-periph-audit/blob/023751a4e987cf7c203ab25d3abba58f7344f213/contracts/oracle/implementations/ARBTriCryptoOracle.sol#L118

Vulnerability details

Impact

It is important to be aware that certain curve pools, such as the stETH/ETH pool, may have a read-only reentrancy vulnerability. This vulnerability can potentially allow an attacker to exploit the pool's functionality in unintended ways, leading to unexpected behavior or security risks. It is recommended to exercise caution and implement appropriate safeguards when working with these pools to mitigate the risk of potential vulnerabilities.

code:

uint256 _vp = TRI_CRYPTO.get_virtual_price();

If TRI_CRYPTO represents the stETH/ETH pool, it is crucial to understand that the oracle price associated with it could be manipulated by an attacker. This manipulation can result in price inflation, ultimately allowing the attacker to gain profits through fraudulent means. It is of utmost importance to implement robust security measures and conduct regular audits to detect and prevent such manipulations, ensuring the integrity and accuracy of the price data associated with the stETH/ETH pool.

Proof of Concept

1. Borrow many eth from flashloan providers such as aave or balancer.
2. Call stEth/ETH add_liquidity function to add liquidity to curve pool.
3. Remove liquidity.
4. Call malicious contract function to gain profits.

reference: https://chainsecurity.com/curve-lp-oracle-manipulation-post-mortem/

Tools Used

vscode

Recommended Mitigation Steps

Calling the pools withdraw_admin_fees function to trigger the reentrancy lock.

Assessed type

Oracle