Submitted by J4X
The EMA oracle, designed to utilize HydraDXs Omnipools and StableSwap for exchange rate information, operates by monitoring activities within these liquidity pools. It looks for specific operations like exchanges, deposits, and withdrawals to adjust the assets exchange rates accordingly. This updating process is not continuous but occurs when the responsible hooks are called by the StableSwap/Omnipool.
The system, although thorough, does not account for price update triggers in the event of direct asset transfers to Stableswap, as these do not set off any hooks within the oracle. This lapse means that such direct transfers can alter asset prices within the liquidity pools without the oracles knowledge, potentially leading to misleading exchange rates.
Moreover, theres a risk of manipulation by bad actors who might use direct transfers to StableSwap in an effort to sway the arbitrage process, especially during periods of network congestion. Such interference could unjustly prevent necessary liquidations within lending protocols.
The issue allows a malicious user to change the price of the AMM without updating the oracle.
The issue can be validated when looking at the runtime configuration. The configuration only restricts transfers to the Omnipool address, but not to the StableSwap address:
The issue can be mitigated by disabling transfers to the StableSwap pools, similar to how it is implemented for the Omnipool.
Oracle
enthusiastmartin (HydraDX) disputed and commented:
Lambda (judge) decreased severity to Low and commented:
J4X (warden) commented:
Lambda (judge) commented:
J4X (warden) commented:
Lambda (judge) increased severity to Medium and commented:
