018.md

Funny Leather Poodle

Medium

Incorrect price calculations in MasterPriceOracle allow for profitable arbitrage attacks.

Summary

The inadequate precision in the price calculations due to improper handling of values will cause a significant financial impact for stakers as the attacker will exploit the rounding errors to manipulate asset valuations.

Root Cause

In MasterPriceOracle.sol:53 the rounding errors in the price calculations lead to incorrect asset valuations.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

1. The attacker queries the price from the oracle.
2. The attacker identifies a significant discrepancy between the oracle price and the actual market price.
3. The attacker buys assets at the manipulated price.
4. The attacker sells the assets at the actual market price, realizing a profit due to the rounding errors in the price calculations.

Impact

The vulnerability allows an attacker to manipulate asset valuations, resulting in financial losses for users who rely on incorrect pricing data.

PoC

No response

Mitigation

No response