Bauer - The quotes from Curve may be subject to manipulation

[sherlock-admin]

Bauer

high

The quotes from Curve may be subject to manipulation

Summary

The get_virtual_price() function in Curve has a reentrancy risk, which can affect the price if the protocol fetches quotes from pools integrated with ETH on Curve.

Vulnerability Detail

The CurveOracle protocol calls the function get_virtual_price_from_lp_token() to obtain a quote from Curve. However, all pools integrated with ETH pose a read-only reentrancy risk. Please refer below link for detail.
https://chainsecurity.com/heartbreaks-curve-lp-oracles/

Impact

The read-only reentrancy operation manipulates the price.

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/oracle/CurveOracle.sol#L101

Tool used

Manual Review

Recommendation

Duplicate of #123