Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Submission Details
Severity: medium
Valid

Potential issue of a flash loan attack in the getPrice function.

Summary

The method used in determining the price of the asset is unreliable as it could lead to a flash loan attack.

Vulnerability Details

Price is gotten on-chain directly from the pool of the token. The issue here is that prices can easily be manipulated. For example, in a given block, an attacker with high liquid can decide to inflate prices which would make the price of tokens at that given block to be wrong. The attacker can then decide to exploit the protocol based on this.

Impact

Financial loss for the protocol as well as many users.

Tools Used

Manual Review

Recommendations

use TWAP to determine the prices of the underlying assets in the pool.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

weak oracle

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.