Submitted by rvierdiiev, also found by 0xMango, d3e4, turvy_fuzz, Udsen, pontifex, jnforja, Madalad, peritoflores, inzinko, deepkin, DarkTower, peanuts, pep7siup, 0xarno, vangrim, aslanbek, mojito_auditor (1, 2), mahyar, nmirchev8, Yanchuan, PENGUN, 0x175, KupiaSec, jasonxiale, Pheonix, rice_cooker, osmanozdemir1, neocrao, twcctop, T1MOH, ast3ros, Kose, bart1e, tnquanghuy0512, openwide, t0x1c (1, 2, 3), zhaojie, Tricko, 0x3b, Bauchibred, chaduke (1, 2), HChang26, RaoulSchaffranek, max10afternoon, ustas, developerjordy, Giorgio, bin2chen, SpicyMeatball, 0xpiken, glcanvas, ElCid, rouhsamad, and zhaojohnson
Price for shares inside Market is calculated using bonding curve. Currently, LinearBondingCurve is supported. This bonging curve increases each next shares with fixed amount and also uses 10% / log2(shareIndex) to calculate fee for the share.
In order to calculate price to buy shares getBuyPrice is used and to calculate price to sell shares getSellPrice is used.
https://github.com/code-423n4/2023-11-canto/blob/main/1155tech-contracts/src/Market.sol#L132-L145
Both functions use IBondingCurve(bondingCurve).getPriceAndFee, but getBuyPrice provides current token index as start index for curve, while getSellPrice provides current token index - amount to sell as start index for curve.
In the case when someone wants to buy shares, the price depends on current circulation supply. If this supply is increased right after a users buy tx, then they will pay more for the shares. If someone sells shares right before the buy tx, then a user will pay a lesser amount (which is good of course).
The same we can say about sell function. If someone sells shares right before a users sell execution, then the user receives a smaller amount. If someone buys shares, then the user gets a bigger amount.
As the price at the moment when user initiates buy or sell function can be changed before execution (with frontrunning or just innocent), this means that slippage protection should be introduced, so a user can be sure that they will not pay more than expected or receive less than expected.
When a user expects to buy shares for 5 USD, then the attacker can sandwich a users tx shares in order to make profit.
The same thing can be done with sell sandwiching. When a user expects to sell their share for 20 USD:
While buy sandwiching needs a user to give the full approval to Market as this price is then sent from user, sell sandwiching doesnt need that because it only sends tokens to the victim.
User can lose funds.
VsCode
Make a user provide slippage to buy, sell, burnNFT and mintNFT functions.
Error
OpenCoreCH (Canto) confirmed
0xTheC0der (judge) decreased severity to Medium and commented:
OpenCoreCH (Canto) commented:
