Summary

Not using an oracle network to get price of asset

Vulnerability Details

The protocol is using a liquidity pool on some exchange to return the price of an asset in WETH.

function getPriceInWeth(address token) public view returns (uint256) {
address swapPoolOfToken = IPoolFactory(s_poolFactory).getPool(token);
return ITSwapPool(swapPoolOfToken).getPriceOfOnePoolTokenInWeth();
}

This is using a single source of truth instead of using a decentralized oracle network to get the price.

Impact

Getting the price from a single source of truth, like a liquidity pool, makes the protocol vulnerable to a price oracle attack. The liquidity pool price can be manipulated in the attacker's favor. See https://chain.link/education-hub/flash-loans for details on price oracle attacks and how to mitigate against them using Chainlink price feeds.

Tools Used

forge, vscode

Recommendations

implement chainlink price feeds in the protocol. Do not use a liquidity pool to get prices.