ERC4626Oracle Vulnerable To Price Manipulation
ERC4626 oracle is vulnerable to price manipulation. This allows an attacker to increase or decrease the price to carry out various attacks against the protocol.\\nThe `getPrice` function within the `ERC4626Oracle` contract is vulnerable to price manipulation because the price can be increased or decreased within a single transaction/block.\\nBased on the `getPrice` function, the price of the LP token of an ERC4626 vault is dependent on the `ERC4626.previewRedeem` and `oracleFacade.getPrice` functions. If the value returns by either `ERC4626.previewRedeem` or `oracleFacade.getPrice` can be manipulated within a single transaction/block, the price of the LP token of an ERC4626 vault is considered to be vulnerable to price manipulation.\\n```\\nFile: ERC4626Oracle.sol\\n    function getPrice(address token) external view returns (uint) {\\n        uint decimals = IERC4626(token).decimals();\\n        return IERC4626(token).previewRedeem(\\n            10 ** decimals\\n        ).mulDivDown(\\n            oracleFacade.getPrice(IERC4626(token).asset()),\\n            10 ** decimals\\n        );\\n    }\\n```\\n\\nIt was observed that the `ERC4626.previewRedeem` couldbe manipulated within a single transaction/block. As shown below, the `previewRedeem` function will call the `convertToAssets` function. Within the `convertToAssets`, the number of assets per share is calculated based on the current/spot total assets and current/spot supply that can be increased or decreased within a single block/transaction by calling the vault's deposit, mint, withdraw or redeem functions. This allows the attacker to artificially inflate or deflate the price within a single block/transaction.\\n```\\nFile: ERC4626.sol\\n    function previewRedeem(uint256 shares) public view virtual returns (uint256) {\\n        return convertToAssets(shares);\\n    }\\n```\\n\\n```\\nFile: ERC4626.sol\\n    function convertToAssets(uint256 shares) public view virtual returns (uint256) {\\n        uint256 supply = totalSupply; // Saves an extra SLOAD if totalSupply is non-zero.\\n\\n        return supply == 0 ? shares : shares.mulDivDown(totalAssets(), supply);\\n    }\\n```\\n
Avoid using `previewRedeem` function to calculate the price of the LP token of an ERC4626 vault. Consider implementing TWAP so that the price cannot be inflated or deflated within a single block/transaction or within a short period of time.\\nSentiment Team\\nDepends on the integration itself, so there's no action that can be taken right now.\\nLead Senior Watson\\nAcknowledged.
The attacker could perform price manipulation to make the apparent value of an asset to be much higher or much lower than the true value of the asset. Following are some risks of price manipulation:\\nAn attacker can increase the value of their collaterals to increase their borrowing power so that they can borrow more assets than they are allowed from Sentiment.\\nAn attacker can decrease the value of some collaterals and attempt to liquidate another user account prematurely.
```\\nFile: ERC4626Oracle.sol\\n    function getPrice(address token) external view returns (uint) {\\n        uint decimals = IERC4626(token).decimals();\\n        return IERC4626(token).previewRedeem(\\n            10 ** decimals\\n        ).mulDivDown(\\n            oracleFacade.getPrice(IERC4626(token).asset()),\\n            10 ** decimals\\n        );\\n    }\\n```\\n