qckhp - Rebalance function can be manipulated by flashloan

[sherlock-admin]

qckhp

high

Rebalance function can be manipulated by flashloan

Summary

The rebalance flow is based on the balance token holdings of the main USSD/DAI pool which can be manipulated by flashloan

Vulnerability Detail

Given a malicious actor
They can manipulate the rebalance function either by flashloaning from the v3 pool or by increasing liquidity as the rebalance checks for the balanceOf the token in the USSD/DAI pool

Impact

If a rebalance needed it can be manipulated and can be forced to buy all the DAI / USSD in the v3 uni pool causing more depeg.

Code Snippet

/// @dev return pool balances with USSD first
    function getSupplyProportion() public view returns (uint256, uint256) {
      uint256 vol1 = IERC20Upgradeable(uniPool.token0()).balanceOf(address(uniPool));
      uint256 vol2 = IERC20Upgradeable(uniPool.token1()).balanceOf(address(uniPool));
      if (uniPool.token0() == USSD) {
        return (vol1, vol2);
      }
      return (vol2, vol1);
    }

https://github.com/USSDofficial/ussd-contracts/blob/f44c726371f3152634bcf0a3e630802e39dec49c/contracts/USSDRebalancer.sol#L84

Tool used

Manual Review

Recommendation

You should use some oracle or TWAP for calculating the holdings of the pool, don't use the balanceOf the pool directly as it can manipulated.

Duplicate of #451