Vulnerability in `PositionInteractionFacet` slippage control due to spot price

Impact: High

Likelihood: Medium

The _swapAssetToAsset function uses the spot price from the Uniswap pool to calculate the amountInMaximum when performing token swaps:

 function _swapAssetToAsset(
        address assetIn,
        address assetOut,
        uint256 amountOut // in assetOut decimals
    ) internal returns (uint256 amountIn) {
        PoolStorage.Layout storage strg = PoolStorage.layout();
        PoolStorage.Dex memory dex = strg.setUp.base.dex;
        uint160 sqrtPriceLimitX96 = 0;

        IQuoterV2.QuoteExactOutputSingleParams memory quoteParams = IQuoterV2.QuoteExactOutputSingleParams({
            tokenIn: assetIn,
            tokenOut: assetOut,
            amount: amountOut,
            fee: dex.dexFee,
            sqrtPriceLimitX96: sqrtPriceLimitX96
        });
        (uint256 amountInMaximum,,,) = IQuoterV2(dex.dexQuoter).quoteExactOutputSingle(quoteParams);
        amountInMaximum = _applySlippage(amountInMaximum);

        IERC20Metadata(assetIn).safeIncreaseAllowance(dex.dexRouter, amountInMaximum);

        --snip--
    }

This exposes the contract to front-running and sandwich attacks, as malicious actors can manipulate the spot price by executing their own transactions. This occurs as follows:

1. An attacker can observe the transaction flow of exerciseOrLiquidatePosition and subsequently the call to _swapAssetToAsset.
2. The attacker can frontrun the transaction and manipulate the spot price in the Uniswap pool.
3. The contract calls quoteExactOutputSingle to determine the amount of the input token (amountInMaximum) required to meet the output token amount (amountOut). This calculation is based on the manipulated spot price.
4. The contract applies slippage tolerance (_applySlippage), which allows for a margin of error in the swap calculation. However, since the spot price is already manipulated to favor the attacker, applying slippage further benefits the attacker.

As a result, the attacker can manipulate the spot price to their advantage, ensuring that the contract swaps tokens at a favorable rate for the attacker, resulting in a loss for the contract.

Consider using a more secure method of price calculation, such as using an oracle or TWAP source to prevent price manipulation from affecting the contract.

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.