Submission Details
Severity:
Potential Oracle Manipulation
Summary
Vulnerability Details
The _raw_price() function calculates price using the stored price parameters.
However, there is no protection against flash loan attacks or price manipulation through unexpected parameter changes.
eg:
If total_supply or total_idle is artificially inflated or deflated, the computed price could be manipulated.
return self._total_assets(parameters) * 10**18 // self._total_supply(parameters, ts)
Impact
Attackers could use a price oracle exploit to mislead price-dependent smart contracts.
Tools Used
Recommendations
Implement time-weighted price calculations and circuit breakers that prevent large price swings.
Prize pool breakdown
Total prize
14,723 OP
Eagles
1,472 OP
nSLOC
39437 OP / LOC
12,700
551
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.