Summary

The MultiFlowPump is designed to handle multiple tokens, but it applies a universal cap for the maximum percentage change of token reserves, represented by the variables LOG_MAX_INCREASE and LOG_MAX_DECREASE. This one-size-fits-all approach may not accurately reflect the inherent volatility of different tokens, potentially distorting the SMA and EMA values.

Vulnerability Details

The smart contract uses immutable variables to cap changes in token reserves per block time passed.

This is implemented in the _capReserve() function, which sets limits on how much token reserves can increase or decrease based on predefined percentages. If a token's reserve changes exceed these limits, the change is capped.

Impact

The uniform cap can lead to inaccurate pricing for tokens that have different volatility profiles:

• Some trading pairs may appear more stale than their actual trading activities.

• While for more other stable tokens, these restrictions might not have any effect at all

Tools Used

Manual review

Recommendations

The different assets volatilities should be taken into account. This is usually the case when working with oracles and AMMs. As UniswapV3 uses different tick spacings while chainlink utilizes different heartbeats for every pair price.
Consider using a token specific LOG_MAX_INCREASE and LOG_MAX_DECREASE in the prices calculation.