Owner of `StrategyPassiveManagerUniswap` can rug-pull users' deposited tokens by manipulating `onlyCalmPeriods` parameters
While `StrategyPassiveManagerUniswap` does have some permissioned roles, one of the attack paths we were asked to check was that the permissioned roles could not rug-pull the users' deposited tokens. There is a way that the owner of the `StrategyPassiveManagerUniswap` contract could accomplish this by modifying key parameters to reduce the effectiveness of the `_onlyCalmPeriods` check. This appears to be how a similar protocol Gamma was exploited.\\nProof of Concept:\\nOwner calls `StrategyPassiveManagerUniswap::setDeviation` to increase the maximum allowed deviations to large numbers or alternatively `setTwapInterval` to decrease the twap interval rendering it ineffective\\nOwner takes a flash loan and uses it to manipulate `pool.slot0` to a high value\\nOwner calls `BeefyVaultConcLiq::deposit` to perform a deposit; the shares are calculated thus:\\n```\\n// @audit `price` is derived from `pool.slot0`\\nshares = _amount1 + (_amount0 * price / PRECISION);\\n```\\n\\nAs `price` is derived from `pool.slot0` which has been inflated, the owner will receive many more shares than they normally would\\nOwner unwinds the flash loan returning `pool.slot0` back to its normal value\\nOwner calls `BeefyVaultConcLiq::withdraw` to receive many more tokens than they should be able to due to the inflated share count they received from the deposit
Beefy already intends to have all owner functions behind a timelocked multi-sig and if these transactions are attempted the suspicious parameters would be an obvious signal that a future attack is coming. Because of this the probability of this attack being effectively executed is low though it is still possible.\\nOne way to further mitigate this attack would be to have a minimum required twap interval and maximum required deviation amounts such that the owner couldn't change these parameters to values which would enable this attack.
Owner of `StrategyPassiveManagerUniswap` can rug-pull users' deposited tokens.
```\\n// @audit `price` is derived from `pool.slot0`\\nshares = _amount1 + (_amount0 * price / PRECISION);\\n```\\n