BugBusters - USSDRebalancer.sol is easy is manipulate due to how how it calculates price in getOwnValuation function

[sherlock-admin]

BugBusters

high

USSDRebalancer.sol is easy is manipulate due to how how it calculates price in getOwnValuation function

Summary

The getOwnValuation() function is vulnerable to price manipulation, which can lead to inaccurate price estimations and financial losses. The vulnerability arises due to the reliance on the Uniswap V3 slot0() without considering the possibility of price manipulation by attackers.
https://github.com/sherlock-audit/2023-05-USSD/blob/6d7a9fdfb1f1ed838632c25b6e1b01748d0bafda/ussd-contracts/contracts/USSDRebalancer.sol#L71-L80

Vulnerability Detail

function getOwnValuation() public view returns (uint256 price) {
      (uint160 sqrtPriceX96,,,,,,) =  uniPool.slot0();
      if(uniPool.token0() == USSD) {
        price = uint(sqrtPriceX96)*(uint(sqrtPriceX96))/(1e6) >> (96 * 2);
      } else {
        price = uint(sqrtPriceX96)*(uint(sqrtPriceX96))*(1e18) >> (96 * 2);
        // flip the fraction
        price = (1e24 / price) / 1e12;
      }
    }

getOwnValuation() uses the uniPool.slot0 to determine the number of tokens it has in it's position. slot0 is the most recent data point and can easily be manipulated.

Attackers can leverage flash swaps to borrow assets from the pool, manipulate the square root price through a series of trades, and then return the borrowed assets. This manipulation impacts subsequent price calculations, including those performed in the getOwnValuation() function.

Impact

The impact could be significant. If an attacker is able to manipulate the price of the token in the Uniswap pool, they could then buy or sell the token at an unfair price. This could lead to users and protocol to loose money

Code Snippet

Tool used

Manual Review

Recommendation

Use a TWAP instead of slot0.

Duplicate of #451