Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

LibUsdOracle incorrectly uses function `LibUniswapOracle.getTwap` to retrieve token price

T1MOH

Summary

When oracleImpl.encodeType == bytes1(0x02) it means that token's price is retrieved in 2 steps: firstly using Uniswap pool against USDT or USDC, and secondly pricing USDT or USDC against USD.
Problem is that incorrect parameters are passed to function to retrieve price from Uniswap pool.

Vulnerability Details

Let's take a look on what LibUniswapOracle.getTwap() does. It returns how much token2 needed to buy amount oneToken of token1:

/**
* @dev Uses `pool`'s Uniswap V3 Oracle to get the TWAP price of `token1` in `token2` over the
* last `lookback` seconds.
* Return value has 6 decimal precision.
* Returns 0 if {IUniswapV3Pool.observe} reverts.
*/
function getTwap(
uint32 lookback,
address pool,
address token1,
address token2,
uint128 oneToken
) internal view returns (uint256 price) {
(bool success, int24 tick) = consult(pool, lookback);
if (!success) return 0;
price = OracleLibrary.getQuoteAtTick(tick, oneToken, token1, token2);
}

So to price Token/USDC we should submit Token as token1 and USDC as token2.

However now in LibUsdOracle.getTokenPriceFromExternal() it submits parameters in the wrong order:

tokenPrice = LibUniswapOracle.getTwap(
lookback == 0 ? LibUniswapOracle.FIFTEEN_MINUTES : uint32(lookback),
oracleImpl.target,
@> chainlinkToken,
@> token,
uint128(10) ** uint128(IERC20Decimals(token).decimals())
);

Impact

Incorrect token price is returned.

Tools Used

Manual Review

Recommendations

Change the order of tokens:

tokenPrice = LibUniswapOracle.getTwap(
lookback == 0 ? LibUniswapOracle.FIFTEEN_MINUTES : uint32(lookback),
oracleImpl.target,
token,
chainlinkToken,
uint128(10) ** uint128(IERC20Decimals(token).decimals())
);
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

LibUsdOracle confuses between baseToken and quoteToken leading to incorrect price quotes

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.