Skip to content

Latest commit

 

History

History
67 lines (39 loc) · 3.12 KB

049.md

File metadata and controls

67 lines (39 loc) · 3.12 KB

Vast Mahogany Fox

High

Malicious actor will manipulate Uniswap pool prices due to slot0 reliance affecting protocol users

Summary

Reliance on Uniswap V3's slot0 value instead of TWAP for price calculations will cause significant price manipulation vulnerabilities for protocol users as attackers can manipulate spot prices through flash loans and large trades.

https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/NumaProtocol/NumaOracle.sol#L329-L386

https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/NumaProtocol/NumaOracle.sol#L164-L175

https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/NumaProtocol/NumaOracle.sol#L257-L315

Root Cause

The use of Uniswap V3's slot0 value for price calculations is a mistake as it appears in three critical functions:

  1. In NumaOracle.sol:164 function getV3SpotPrice uses slot0 directly for price calculations
  2. In NumaOracle.sol:257 function getV3SqrtLowestPrice uses slot0 for price boundaries
  3. In NumaOracle.sol:329 function getV3SqrtHighestPrice uses slot0 for price boundaries

In all these cases, the contract relies on the current spot price from slot0 instead of using time-weighted average prices (TWAP), making it vulnerable to price manipulation.

Internal pre-conditions

  1. The contract must be actively using one of the three vulnerable functions for price calculations
  2. The contract must have sufficient liquidity to make price manipulation profitable

External pre-conditions

  1. Uniswap V3 pool must have enough liquidity to allow for significant price movement
  2. Flash loan providers must be available to provide capital for manipulation
  3. Gas prices must be low enough to make the attack profitable

Attack Path

  1. Attacker identifies opportunity to manipulate price through one of the vulnerable functions
  2. Attacker takes out a flash loan for significant capital
  3. Attacker executes large trades on the Uniswap V3 pool to manipulate the spot price
  4. During the same transaction, attacker interacts with the protocol while prices are manipulated
  5. Attacker repays flash loan and keeps profits from the manipulation

Impact

The protocol users suffer potential losses due to price manipulation, with impact varying based on which function is exploited:

  • For getV3SpotPrice: Direct price manipulation affecting all spot price-based calculations
  • For getV3SqrtLowestPrice: Manipulation of price boundaries affecting minimum price calculations
  • For getV3SqrtHighestPrice: Manipulation of price boundaries affecting maximum price calculations

The attacker can potentially gain significant profits by exploiting the price differences between manipulated spot prices and actual market prices, while protocol users face losses from incorrect pricing.

PoC

No response

Mitigation

Mitigation requires replacing all slot0 usage with TWAP calculations to provide manipulation resistance:

  1. Replace getV3SpotPrice with TWAP-based calculations
  2. Modify price boundary calculations in getV3SqrtLowestPrice and getV3SqrtHighestPrice to use short-interval TWAP instead of spot prices