Anubis - Vulnerability in External Contract Calls

[sherlock-admin2]

Anubis

high

Vulnerability in External Contract Calls

Summary

The DelayedOrder contract is vulnerable due to insufficient validation of external price data in the executeOrder function, potentially allowing market manipulation.
##Vulnerability Detail
Consider a function in DelayedOrder that relies on price data from an external oracle or contract. If this external source is compromised or manipulates the data, it could lead to incorrect transaction executions within DelayedOrder.

Impact

1. Attacker's Manipulated Data:
-Attacker provides a manipulated price of an asset: Reported as $80, but the true market price is $100.
2. Execution of Trades:
-Attacker buys 100 units of the asset at the manipulated price of $80, spending $8,000 (100 units * $80).
3. Price Correction and Attacker's Sale:
-When the price corrects to its true value of $100, the attacker sells these 100 units, receiving $10,000 (100 units * $100).
4. Profit Realization:
-Attacker's profit: $10,000 (sale) - $8,000 (purchase) = $2,000.
5. Impact on Other Users:
-Other users, who sold at the manipulated price, incur a loss of $20 per unit (True price $100 - Manipulated price $80).

Code Snippet

https://github.com/sherlock-audit/2023-12-flatmoney/blob/main/flatcoin-v1/src/DelayedOrder.sol#L378-L387

Tool used

Manual Review

Recommendation

Enhanced Data Validation:
Implement stringent validation of external price data to prevent exploitation.

function validateExternalData(bytes[] calldata priceUpdateData) internal view {
    // Logic for validating external data
}

function executeOrder(
    address account,
    bytes[] calldata priceUpdateData
) external payable nonReentrant whenNotPaused {
    validateExternalData(priceUpdateData);  // Implementing robust validation
    // ...
}

This fix aims to prevent market manipulation by ensuring the integrity and reliability of the price data used in order executions.

[sherlock-admin]

1 comment(s) were left on this issue during the judging contest.

takarez commented:

invalid

[nevillehuang]

Seemingly duplicate of #188 but Invalid, checks for valid pyth price to update trusted to be done by out of scope contracts as seen here