Canto Dex Oracle contest - rokinot's results

Lines of code

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-core.sol#L560-L568

Vulnerability details

Impact

The oracle reading will be unable to be updated.

Proof of Concept

Assuming the gas limit is similar to Ethereum, which is 30m as of today (Note that some EVM-based layer-1s like AVAX have an even lower block limit), and using the setPeriodSize() execution cost as parameter, if Canto DEX reaches a number around ~1k in pairs (one could argue it's a realistic achievement) this execution will surpass the block limit.

According to the docs the DAO can increase the gas limit, however this may be a slow process and a bad actor could create mock tokens and mock pairs in order to grief the DEX.

Tools Used

Code reading

Recommended Mitigation Steps

The function could take a number of indexes instead of all at once, and since this operation does not happen too often, the admin could pause swaps until they're all updated.

It's also possible to store this variable on BaseV1Factory instead since it's a standard value that is to be used for all pairs, and add a public view function on BaseV1Pair that does an external call to get the variable from the factory contract.

Low

Stables cTokens prices are hard set to 1e18, however cStables/Stables or even cStables/cStables pairs will have variant prices in terms of Note (i.e. cUSDC/cUSDT will have prices that can be different than 1e18).

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L549

Non-critical

Wrong comment, should be WCANTO instead of WETH

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L85

Contracts can force deposit canto by calling selfdestruct

Although there's no vulnerability involved, this goes against what the comment says.

https://github.com/code-423n4/2022-09-canto/blob/main/src/Swap/BaseV1-periphery.sol#L85