Maverick oracle can be manipulated
In the MavEthOracle contract, `getPriceInEth` function utilizes the reserves of the Maverick pool and multiplies them with the external prices of the tokens (obtained from the rootPriceOracle contract) to calculate the total value of the Maverick position.\\n```\\n// Get reserves in boosted position.\\n(uint256 reserveTokenA, uint256 reserveTokenB) = boostedPosition.getReserves();\\n\\n// Get total supply of lp tokens from boosted position.\\nuint256 boostedPositionTotalSupply = boostedPosition.totalSupply();\\n\\nIRootPriceOracle rootPriceOracle = systemRegistry.rootPriceOracle();\\n\\n// Price pool tokens.\\nuint256 priceInEthTokenA = rootPriceOracle.getPriceInEth(address(pool.tokenA()));\\nuint256 priceInEthTokenB = rootPriceOracle.getPriceInEth(address(pool.tokenB()));\\n\\n// Calculate total value of each token in boosted position.\\nuint256 totalBoostedPositionValueTokenA = reserveTokenA * priceInEthTokenA;\\nuint256 totalBoostedPositionValueTokenB = reserveTokenB * priceInEthTokenB;\\n\\n// Return price of lp token in boosted position.\\nreturn (totalBoostedPositionValueTokenA + totalBoostedPositionValueTokenB) / boostedPositionTotalSupply;\\n```\\n\\nHowever, the reserves of a Maverick position can fluctuate when the price of the Maverick pool changes. Therefore, the returned price of this function can be manipulated by swapping a significant amount of tokens into the Maverick pool. An attacker can utilize a flash loan to initiate a swap, thereby changing the price either upwards or downwards, and subsequently swapping back to repay the flash loan.\\nAttacker can decrease the returned price of MavEthOracle by swapping a large amount of the higher value token for the lower value token, and vice versa.\\nHere is a test file that demonstrates how the price of the MavEthOracle contract can be manipulated by swapping to change the reserves.
Use another calculation for Maverick oracle
There are multiple impacts that an attacker can exploit by manipulating the price of MavEthOracle:\\nDecreasing the oracle price to lower the totalDebt of LMPVault, in order to receive more LMPVault shares.\\nIncreasing the oracle price to raise the totalDebt of LMPVault, in order to receive more withdrawn tokens.\\nManipulating the results of the Stats contracts to cause miscalculations for the protocol.
```\\n// Get reserves in boosted position.\\n(uint256 reserveTokenA, uint256 reserveTokenB) = boostedPosition.getReserves();\\n\\n// Get total supply of lp tokens from boosted position.\\nuint256 boostedPositionTotalSupply = boostedPosition.totalSupply();\\n\\nIRootPriceOracle rootPriceOracle = systemRegistry.rootPriceOracle();\\n\\n// Price pool tokens.\\nuint256 priceInEthTokenA = rootPriceOracle.getPriceInEth(address(pool.tokenA()));\\nuint256 priceInEthTokenB = rootPriceOracle.getPriceInEth(address(pool.tokenB()));\\n\\n// Calculate total value of each token in boosted position.\\nuint256 totalBoostedPositionValueTokenA = reserveTokenA * priceInEthTokenA;\\nuint256 totalBoostedPositionValueTokenB = reserveTokenB * priceInEthTokenB;\\n\\n// Return price of lp token in boosted position.\\nreturn (totalBoostedPositionValueTokenA + totalBoostedPositionValueTokenB) / boostedPositionTotalSupply;\\n```\\n