Summary

The method used in determining the price of the asset is unreliable as it could lead to a flash loan attack.

Vulnerability Details

Price is gotten on-chain directly from the pool of the token. The issue here is that prices can easily be manipulated. For example, in a given block, an attacker with high liquid can decide to inflate prices which would make the price of tokens at that given block to be wrong. The attacker can then decide to exploit the protocol based on this.

Impact

Financial loss for the protocol as well as many users.

Tools Used

Manual Review

Recommendations

use TWAP to determine the prices of the underlying assets in the pool.