The strict inequality check in updateDelay verification creates an exploitable time window where multiple price updates can occur sequentially #124
Labels
invalid
This doesn't seem right
Comments
geaxed
added
invalid
|
This looks GPT-generated.
I don't understand from this sentence how using |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Github username: @emerald7017
Twitter username: --
Submission hash (on-chain): 0xd8904d46499f4744655250e2dc71bec9df4b2130dc9d2558f5634a11c40be1ca
Severity: high
Description:
Summary
YieldOracle contract contains a timing vulnerability that allows for price manipulation through precise transaction ordering, affecting the protocol's value calculations and ERC4626 vault operations.
Finding Description
The vulnerability arises from the use of a strict inequality in the update delay check within
updatePricefunction. This allows multiple price updates to occur back-to-back at the exact updateDelay interval. An attacker can exploit this by front-running and back-running legitimate oracle updates, manipulating the price used for asset/share conversions in the InvestToken contract. This breaks the security guarantee of accurate and fair pricing within the protocol.YieldOracle.sol:L69-L85
InvestToken.sol.L213L213
The strict inequality check in
updateDelayverification creates an exploitable time window where multiple price updates can occur sequentially, enabling price manipulation that propagates through the entire protocol's value calculation system.Impact Explanation
The impact is imminent because it compromises the integrity of the price oracle, which is central to the protocol's operations. Manipulated prices can lead to incorrect share pricing, asset conversions, and potential financial losses for users. This vulnerability allows for MEV extraction and systemic risk to the protocol's value calculations.
Attack Scenario
Objective: The attacker aims to manipulate the price reported by the
YieldOraclecontract to achieve a significant overall change over time, without triggering the constraints that prevent large, single-step price changes.Mechanism of Exploit:
maxPriceIncrease. This is done multiple times to accumulate a significant price shift.updateDelayandcommitDelay, the attacker ensures that each update is allowed by the contract's timing constraints.Likelihood Explanation
Given that, it can be exploited by any entity capable of monitoring the blockchain mempool and timing transactions precisely. The use of automated bots makes this attack feasible and likely in a competitive DeFi environment.
Proof of Concept
This PoC demonstrates how the timing vulnerability allows for price manipulation, affecting the protocol's value calculations and ERC4626 vault operations. The ability to sandwich legitimate updates with manipulated ones can lead to incorrect share pricing and asset conversions.
1. Setup:
setUpfunction initializes theYieldOraclecontract and sets the initial price and update delay. It also grants the oracle role to theoracleOperator.2. Initial State: The initial price is logged to show the starting point.
3. Alice Front-runs: Alice (acting as the oracle operator) updates the price to 1100 at exactly
T + updateDelay.4. Bob's Legitimate Update: Bob submits a legitimate update to 1050, which succeeds immediately after Alice's update due to the timing vulnerability.
5. Alice Back-runs: Alice back-runs with another update to 1150, demonstrating the ability to manipulate the price.
6. Final State: The final prices are logged to show the manipulated state.
The Logs
Initial State:
1000.000000000000000000.Exploit Attempts:
maxPriceIncrease).nextPriceand then commits it tocurrentPrice.Final State:
1000.499999999999999995, showing a significant increase from the initial price.1000.399999999999999996, indicating the last committed price before the final update.The Traces Show
This vulnerability could break certain security guarantees and potentially be exploited by a malicious actor. The security implications and how this vulnerability can be exploited:
Security Guarantees Broken
1. Price Stability: The primary function of a yield oracle is to provide a stable and reliable price feed. This vulnerability allows an attacker to manipulate the price over time, breaking the guarantee of price stability.
2. Integrity of Price Updates: The contract is expected to enforce constraints on how much the price can change in a single update (
maxPriceIncrease). However, by making repeated updates just within the allowed bounds, an attacker can bypass the intended constraints and significantly alter the price.3. Economic Security: If the price is manipulated, it can lead to incorrect valuations of assets or shares, affecting users who rely on the oracle for accurate pricing. This can have cascading effects on any financial instruments or contracts that depend on the oracle.
How the Vulnerability is Exploited
1. Repeated Small Updates: The test demonstrates how an attacker can repeatedly update the price by a small amount, just within the allowed
maxPriceIncrease. Over multiple iterations, these small changes accumulate to a significant price shift.2. Timing Manipulation: The test simulates how an attacker could exploit the
updateDelayandcommitDelayto make frequent updates without waiting for real-time delays.3. Propagation of Malicious Input: This input propagates through the system, updating
nextPriceand committing it tocurrentPrice, ultimately leading to a manipulated price.Recommendation (Optional)
Enforce strict timing requirements and add proper price validation to prevent manipulation.
function updatePrice(uint256 price) external onlyOracle { - require(lastUpdate + updateDelay < block.timestamp, "Insufficient update delay"); + require(lastUpdate + updateDelay <= block.timestamp, "Insufficient update delay"); + // Add minimum delay between updates + require(block.timestamp - lastUpdate >= updateDelay, "Update too soon"); // Add price sanity checks + // Enhanced price validation + require(price >= currentPrice, "Price cannot decrease"); + require(price - currentPrice <= maxPriceIncrease, "Price increase too large"); + require(price >= MIN_PRICE, "Below minimum price"); }The text was updated successfully, but these errors were encountered: