theOwl - Price reading from Uniswap pool can be manipulated

[sherlock-admin]

theOwl

high

Price reading from Uniswap pool can be manipulated

Summary

USSDRebalancer is reading the price of the USSD/DAI pair directly from the pool, this price can be manipulated using flashloan for the attacker's profit.

Vulnerability Detail

USSDRebalancer calculate the price of USSD/DAI using the function getOwnValuation, first read the price directly from pool and here is where the problem is originating, as the contract reads the price directly from the pool and is not using the twap oracle, the price can be manipulated atomically using a flash loan to inflate the price of one asset.

Impact

The price that is read can be manipulated through the flash loan.

POC:

1. Take flashLoan to inflate the pool price.
2. Buy USSD for nothing ( a few DAI cents for millions of USSD )
3. Call rebalance function where the USSD will try to rebalance the USSD/DAI pool
4. Sell back the USSD at normal price + profit and pay the flash loan

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/6d7a9fdfb1f1ed838632c25b6e1b01748d0bafda/ussd-contracts/contracts/USSDRebalancer.sol#L72
https://github.com/sherlock-audit/2023-05-USSD/blob/6d7a9fdfb1f1ed838632c25b6e1b01748d0bafda/ussd-contracts/contracts/USSDRebalancer.sol#L93

Tool used

Manual Review

Recommendation

Read the price using Uniswap TWAP instead of reading it directly from the pool

Duplicate of #451