shogoki - Rebalancing is suspectible to Flash Loan Attacks

[sherlock-admin]

shogoki

high

Rebalancing is suspectible to Flash Loan Attacks

Summary

The Rebalancing function uses the internal getOwnValuation() function, which get´s the curren tprice from a UniswapV3 Pool. This is vunerable to FlashLoan Attacks as the price can be easily manipulated in either direction by an attacker.
As the rebalance function is also public and can be called by anyone, an attacker can force any behaviour of the function by manipulating the price into the desired direction.

Vulnerability Detail

In USSDRebalancer.sol:71-80 the getOwnValuation() function relies on the current price from the UniswapV3 pool by fetching the data from slot0(). This is not the intended way to use an Uniswapv3 Pool as a price oracle, because it is suspectible to Flash Loan Attacks.
This function is then used in the public accessible rebalance() function to determine if the USSD token is at Peg. If the Token depegged from DAI by more than the allowed threshold actions are taken to either buy or sell USSD token.
In conjunction with a Sandwich attack (because there is no slippage protection in the UniswapV3 call) this allows the attacker to drain almost all collateral funds.

An Attacker can do the following:

• take flash loan and buy collateral tokens in respective pools
• fake a depeg the USSD below 1 DAI, by manipulating the uniswapV3 Poolprice (using flashloan)
• call rebalance to force the Rebalancer Contract to sell the Collateral tokens (in our pools) for a too high price and buy USSD
• sell the bought collateral tokens for a higher price
• payback flashloan

By this an attacker can take a massive profit by taking the value out of the USSD collateral pools.

Impact

Attackers can "steal" almost all collateral funds.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/USSDRebalancer.sol#L71-L80

Tool used

Manual Review

Recommendation

Do not rely on the slot0 fetched price from the UniswapV3 pool.

Duplicate of #451