Upgraded Q -> 2 from #537 [1727786902479]

[c4-judge]

Judge has assessed an item in Issue #537 as 2 risk. The relevant finding follows:

12. Calls to balancer’s getPoolTokens should use reentrancy protection
    Links to affected code *

https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/oracle/BalancerOracle.sol#L82

Impact
Balancer disclosed a read-only reentrancy vulnerability in the Balancer Vault. The effect of this reentrancy is that Balancer pools are susceptible to manipulation of their external queries. What this means is that integrations with balancer vaults must carefully assess the data returned from the vaults. Some protocols, were unaware of this got hacked as a result. One of the functions affected is the getPoolTokens function which is queried when BalancerOracle.sol is deployed. Via reentrancy, an attacker can force token balances and BPT supply to be out of sync, creating very inaccurate BPT prices.

constructor(

//...
(address[] memory tokens, , ) = balancerVault.getPoolTokens(poolId);
//...
Also, price updates are made quering various price calculations using pool totalSupply, normalized weights, so it is clearly vulnerable to synchronization issues between the data points.

function update() external virtual onlyRole(KEEPER_ROLE) returns (uint256 safePrice_) {
    if (block.timestamp - lastUpdate < updateWaitWindow) revert BalancerOracle__update_InUpdateWaitWindow();
    // update the safe price first
    safePrice = safePrice_ = currentPrice;
    lastUpdate = block.timestamp;

    uint256[] memory weights = IWeightedPool(pool).getNormalizedWeights();
    uint256 totalSupply = IWeightedPool(pool).totalSupply();

    uint256 totalPi = WAD;
    uint256[] memory prices = new uint256[](weights.length);
    // update balances in 18 decimals
    for (uint256 i = 0; i < weights.length; i++) {
        // reverts if the price is invalid or stale
        prices[i] = _getTokenPrice(i);
        uint256 val = wdiv(prices[i], weights[i]);
        uint256 indivPi = uint256(wpow(int256(val), int256(weights[i])));

        totalPi = wmul(totalPi, indivPi);
    }

    currentPrice = wdiv(wmul(totalPi, IWeightedPool(pool).getInvariant()), totalSupply);
}

Recommended Mitigation Steps
Recommend using the provided balancer library to protect from these manipulations.

[c4-judge]

koolexcrypto changed the severity to 3 (High Risk)

[c4-judge]

koolexcrypto marked the issue as duplicate of #226

[c4-judge]

koolexcrypto marked the issue as satisfactory

[c4-judge]

This auto-generated issue was withdrawn by koolexcrypto