LP tokens cannot be valued because ICHI cannot be priced by oracle, causing all new open positions to revert
In order to value ICHI LP tokens, the oracle uses the Fair LP Pricing technique, which uses the prices of both individual tokens, along with the quantities, to calculate the LP token value. However, this process requires the underlying token prices to be accessible by the oracle. Both Chainlink and Band do not support the ICHI token, so the function will fail, causing all new positions using the IchiVaultSpell to revert.\\nWhen a new Ichi position is opened, the ICHI LP tokens are posted as collateral. Their value is assessed using the `IchiLpOracle#getPrice()` function:\\n```\\nfunction getPrice(address token) external view override returns (uint256) {\\n    IICHIVault vault = IICHIVault(token);\\n    uint256 totalSupply = vault.totalSupply();\\n    if (totalSupply == 0) return 0;\\n\\n    address token0 = vault.token0();\\n    address token1 = vault.token1();\\n\\n    (uint256 r0, uint256 r1) = vault.getTotalAmounts();\\n    uint256 px0 = base.getPrice(address(token0));\\n    uint256 px1 = base.getPrice(address(token1));\\n    uint256 t0Decimal = IERC20Metadata(token0).decimals();\\n    uint256 t1Decimal = IERC20Metadata(token1).decimals();\\n\\n    uint256 totalReserve = (r0 * px0) /\\n        10**t0Decimal +\\n        (r1 * px1) /\\n        10**t1Decimal;\\n\\n    return (totalReserve * 1e18) / totalSupply;\\n}\\n```\\n\\nThis function uses the "Fair LP Pricing" formula, made famous by Alpha Homora. To simplify, this uses an oracle to get the prices of both underlying tokens, and then calculates the LP price based on these values and the reserves.\\nHowever, this process requires that we have a functioning oracle for the underlying tokens. However, Chainlink and Band both do not support the ICHI token (see the links for their comprehensive lists of data feeds). As a result, the call to `base.getPrice(token0)` will fail.\\nAll prices are calculated in the `isLiquidatable()` check at the end of the `execute()` function. As a result, any attempt to open a new ICHI position and post the LP tokens as collateral (which happens in both `openPosition()` and openPositionFarm()) will revert.
There will need to be an alternate form of oracle that can price the ICHI token. The best way to accomplish this is likely to use a TWAP of the price on an AMM.
All new positions opened using the `IchiVaultSpell` will revert when they attempt to look up the LP token price, rendering the protocol useless.\\nThis vulnerability would result in a material loss of funds and the cost of the attack is low (relative to the amount of funds lost). The attack path is possible with reasonable assumptions that mimic on-chain conditions. The vulnerability must be something that is not considered an acceptable risk by a reasonable protocol team.\\nsherlock-admin\\nEscalate for 31 USDC\\nImpact stated is medium, since positions cannot be opened and no funds are at risk. The high severity definition as stated per Sherlock docs:\\nThis vulnerability would result in a material loss of funds and the cost of the attack is low (relative to the amount of funds lost). The attack path is possible with reasonable assumptions that mimic on-chain conditions. The vulnerability must be something that is not considered an acceptable risk by a reasonable protocol team.\\nYou've created a valid escalation for 31 USDC!\\nTo remove the escalation from consideration: Delete your comment. To change the amount you've staked on this escalation: Edit your comment (do not create a new comment).\\nYou may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.\\nhrishibhat\\nEscalation accepted\\nThis is a valid medium Also Given that this is an issue only for the Ichi tokens and impact is only unable to open positions.\\nsherlock-admin\\nEscalation accepted\\nThis is a valid medium Also Given that this is an issue only for the Ichi tokens and impact is only unable to open positions.\\nThis issue's escalations have been accepted!\\nContestants' payouts and scores will be updated according to the changes made on this issue.
```\\nfunction getPrice(address token) external view override returns (uint256) {\\n    IICHIVault vault = IICHIVault(token);\\n    uint256 totalSupply = vault.totalSupply();\\n    if (totalSupply == 0) return 0;\\n\\n    address token0 = vault.token0();\\n    address token1 = vault.token1();\\n\\n    (uint256 r0, uint256 r1) = vault.getTotalAmounts();\\n    uint256 px0 = base.getPrice(address(token0));\\n    uint256 px1 = base.getPrice(address(token1));\\n    uint256 t0Decimal = IERC20Metadata(token0).decimals();\\n    uint256 t1Decimal = IERC20Metadata(token1).decimals();\\n\\n    uint256 totalReserve = (r0 * px0) /\\n        10**t0Decimal +\\n        (r1 * px1) /\\n        10**t1Decimal;\\n\\n    return (totalReserve * 1e18) / totalSupply;\\n}\\n```\\n