Panoptic - sammy's results

Lines of code

https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/PanopticFactory.sol#L341

Vulnerability details

The creation of a pool requires the creator to mint full-range liquidity into the corresponding Uniswap V3 pool. However, this fullRangeLiquidity is calculated using the slot0 SqrtPriceX96 from the Uniswap pool, which is susceptible to manipulation.

Impact

MEV bots can utilize flash loans to front-run the creation of a pool, thereby increasing the costs for the user. The user may end up paying more token0 and token1 than necessary for creating the pool. Subsequently, these bots may execute trades that profit from the inflated prices after the pool's creation.

Proof of Concept

Tools Used

Manual Review

Recommended Mitigation Steps

Implement the use of TWAP (Time-Weighted Average Price) instead.

Assessed type

MEV

Lines of code

https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/CollateralTracker.sol#L446

Vulnerability details

The calculation of the maximum shares received for a deposit in CollateralTracker.sol is incorrect.

In the mint() function, the assets received for a mint are being calculated using the previewMint() function, which has a mismatch with the current maxMint() function in the scenario in which the max possible assets are being deposited for the mint.

Impact

Detailed description of the impact of this finding.

Proof of Concept

Currently the maxMint() function calculates the max shares as follows :

 maxShares = (((type(uint104).max)*totalSupply()/totalAssets())*DECIMALS)/(DECIMALS+COMMISSION_FEE)

and previewMint() calculates the assets received as :

assets = (shares*DECIMALS*totalAssets())/(totalSupply*(DECIMALS-COMISSION_FEE))

In the max mint scenario, let's assume the assets required are maximum, i.e, type(uint104).max :

type(uint104).max = (maxShares*DECIMALS*totalAssets())/(totalSupply*(DECIMALS-COMISSION_FEE))

Simplifying, we get : 

maxShares = (type(uint104).ma0x)*totalSupply*(DECIMALS-COMISSION_FEE)/DECIMALS*totalAssets()

The derived formula does not match the formula used in maxMint() leading to incorrect calculation of shares.

Tools Used

Manual Review

Recommended Mitigation Steps

-            return (convertToShares(type(uint104).max) * DECIMALS) / (DECIMALS + COMMISSION_FEE);
+            return (convertToShares(type(uint104).max) * (DECIMALS - COMMISSION_FEE)) / DECIMALS;


## Assessed type

Error