Submitted by 0xAadi, also found by bareli, 0x11singh99, and hihen
The MagicLpAggregator contract contains a flaw within the _getReserves function where it fails to return the reserve values fetched from the pair contract. This oversight results in the latestAnswer function always returning zero, which can have severe implications for any systems that depend on this contract for accurate liquidity pool pricing data.
The missing return statement in the _getReserves function leads to the latestAnswer function always returning zero. This affects any dependent systems or contracts that rely on accurate price data from the MagicLpAggregator contract, as they will receive incorrect information, potentially leading to financial loss or system failure.
The _getReserves function in the provided code snippet does not return the fetched reserves:
https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/oracles/aggregators/MagicLpAggregator.sol#L33C5-L35C6
Due to the missing return statement, the latestAnswer function uses uninitialized variables for baseReserve and quoteReserve, which default to zero:
https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/oracles/aggregators/MagicLpAggregator.sol#L42C1-L44C69
Update _getReserves()
0xCalibur (Abracadabra) confirmed and commented:
Note: For full discussion, see here.
