ParaSpace contest - poirots's results

Lines of code

https://github.com/code-423n4/2022-11-paraspace/blob/c6820a279c64a299a783955749fdc977de8f0449/paraspace-core/contracts/misc/UniswapV3OracleWrapper.sol#L241-L277

Vulnerability details

Impact

The general idea of this snippet is to compute the square root of a price ratio:

The first case (decimals are equal) adds an adjustment which is meant to preserve the final value in wei

Note: we intentionaly skip here the 2**92 component, to keep the formulas here succint.

However, for the last case (oracleData.token1Decimal < oracleData.token0Decimal), the given formula appears different from the one that would be reached in the process above:

It seems the square root was incorrectly ignored on the last branch, since the second component doesn’t match the code 1 / 10^(9 + d0 = d1) (It both misses the square root, and transforms the 18 into a 9 incorrectly)

Tools Used

Manual analysis. Pen & paper. Excel

Recommended Mitigation Steps