rvierdiiev - TWAPOracleDollar3poolFacet.setPool can be griefed

[sherlock-admin]

rvierdiiev

medium

TWAPOracleDollar3poolFacet.setPool can be griefed

Summary

Attacker can not allow ubiqiuty protocol to call TWAPOracleDollar3poolFacet.setPool, because of pool balance check

Vulnerability Detail

TWAPOracleDollar3poolFacet.setPool function allows protocol to set their curve pool that will be used to fetch prices.
The function has balance check that wants reserves to be equal.

Such check allows anyone to change reserves in the pool, before setPool call in order to make tx fail. Then protocol will need to redeploy library and remove check or create a script that will control balance in the pool to be equal to be able to set the pool.

Impact

Attacker can not allow to setPool.

Code Snippet

Provided above

Tool used

Manual Review

Recommendation

Remove that check.

Duplicate of #14

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

auditsea commented:

The issue describes about DOSing setPool function by manipulating the Curve pool, but it's assumed that the Curve pool deployment, LP deposit, and setPool will be handled in one tx using multicall structure

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

auditsea commented:

The issue describes about DOSing setPool function by manipulating the Curve pool, but it's assumed that the Curve pool deployment, LP deposit, and setPool will be handled in one tx using multicall structure