ni8mare - Using slot0 to calculate prices can be manipulated.

[sherlock-admin]

ni8mare

medium

Using slot0 to calculate prices can be manipulated.

Summary

Using slot0 to calculate the token price can be easily manipulated.

Vulnerability Detail

The function getOwnValuation() in USSDRebalancer uses slot0 to calculate price:

    function getOwnValuation() public view returns (uint256 price) {
      (uint160 sqrtPriceX96,,,,,,) =  uniPool.slot0();
      if(uniPool.token0() == USSD) {
        price = uint(sqrtPriceX96)*(uint(sqrtPriceX96))/(1e6) >> (96 * 2);
      } else {
        price = uint(sqrtPriceX96)*(uint(sqrtPriceX96))*(1e18 /* 1e12 + 1e6 decimal representation */) >> (96 * 2);
        // flip the fraction
        price = (1e24 / price) / 1e12;
      }
    }

But, slot0 returns the most recent data point and hence can be easily manipulated. Please check a similar issue which was reported here.

Impact

The function getOwnValuation is again used in the SellUSSDBuyCollateral() and rebalance() and hence these functions could be manipulated as well.

Code Snippet

https://github.com/USSDofficial/ussd-contracts/blob/f44c726371f3152634bcf0a3e630802e39dec49c/contracts/USSDRebalancer.sol#L72

Tool used

Manual Review

Recommendation

To determine the price, use a TWAP instead of slot0 of uniswapV3pool.

Duplicate of #451