Skip to content

Latest commit

 

History

History
26 lines (17 loc) · 799 Bytes

013.md

File metadata and controls

26 lines (17 loc) · 799 Bytes

Proud Rusty Mantis

Medium

NumaOracle.getV3SqrtPriceAvg() does not round down for negative ticks

Vulnerability Detail

In the function mentioned in the title, we have the following piece of code:

(int56[] memory tickCumulatives, ) = IUniswapV3Pool(_uniswapV3Pool).observe(secondsAgo);

        // tick(imprecise as it's an integer) to sqrtPriceX96
        return TickMath.getSqrtRatioAtTick(int24((tickCumulatives[1] - tickCumulatives[0]) / int56(int32(_interval))));

This is problematic as we should be rounding down the result for negative tuck cumulative delta (if the result would be a floating number in "normal" maths).

Attack Path

No response

Impact

Incorrect tick and thus, wrong price used in the protocol

Mitigation

Round down for negative delta