Skip to content

Latest commit

 

History

History
42 lines (25 loc) · 1.54 KB

083.md

File metadata and controls

42 lines (25 loc) · 1.54 KB

peanuts

high

quoteSpecificPoolsWithTimePeriod() will not work because dependency is not integrated

Summary

quoteSpecificPoolsWithTimePeriod() uses Mean-Finance integration which is not installed in the protocol.

Vulnerability Detail

StaticOracle is a tool developed by Mean Finance under Uniswap's grant program that aims to help developers integrate easily and fast with Uniswap's v3 TWAP oracles. StaticOracle will allow developers to:

  • Prepare a set of pools (for example: by a token pair and a fee tier) to support a certain period of time (for example: 60 seconds).
  • Quote a TWAP for a set of pools (for example: by a token pair and a fee tier, or addresses).

The package is missing from the dependency folder. Integrating the StaticOracle should look something like this in package.json:

  "dependencies": {
    "@mean-finance/uniswap-v3-oracle": "^1.0.3",
    "@openzeppelin/contracts": "^4.7.3",

Impact

quoteSpecificPoolsWithTimePeriod() will not work.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBGL.sol#L28 https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L36

Tool used

Manual Review

Recommendation

Recommend following the instructions on Mean-Finance's github to integrate the functions of StaticOracle properly. Add the dependency with npm install @mean-finance/uniswap-v3-oracle

https://github.com/Mean-Finance/uniswap-v3-oracle/tree/9935263665c5a16f9c385e909bcc6edcc8d56970