005.md

Teeny Menthol Osprey

Medium

"Failure to Return Short and Long Intervals in getV3SqrtPriceAvg() Function"

Summary

https://github.com/NumaMoney/Numa/blob/c6476d828f556967e64410b5c11c1f2cd77220c7/contracts/NumaProtocol/NumaOracle.sol#L226

When the interval is zero (interval == 0), the function should return the current TWAP prices for both the short and long intervals. However, the code does not handle the return of the current TWAP prices for these intervals.

Impact

The current TWAP prices for short and long intervals are not returned

Mitigation

Ensure that when interval == 0, the function explicitly returns the current TWAP prices for both the short and long intervals using slot0() from the UniswapV3Pool. This guarantees accurate and expected behavior for all valid input scenarios.

    function getV3SqrtPriceAvg(    
        address _uniswapV3Pool,
        uint32 _interval
    ) public view returns 
      ++ (uint160 sqrtPriceX96 ) {
      --  require(_interval > 0, "interval cannot be zero");

      ++    if (_interval == 0) {
             //Returns TWAP prices for short and long intervals
      ++      (sqrtPriceX96, , , , , , ) = IUniswapV3Pool(_uniswapV3Pool)
                .slot0();
      ++  } else {
            uint32[] memory secondsAgos = new uint32[](2);
            secondsAgos[0] = twapInterval; // from (before)
            secondsAgos[1] = 0; // to (now)

        (int56[] memory tickCumulatives, ) = IUniswapV3Pool(_uniswapV3Pool)
            .observe(secondsAgo);

        // tick(imprecise as it's an integer) to sqrtPriceX96
        return
            TickMath.getSqrtRatioAtTick(
                int24(
                    (tickCumulatives[1] - tickCumulatives[0]) /
                    --    int56(int32(_interval))
                    ++    int32(_interval)
                )
            );
    }

Instead of having the _uniswapV3Pool as an input it is best to have it as a state variable to avoid any issues regarding address.