SilentDefendersOfDeFi - Prevent Healing of Agents by price manipulation about 2023-10-looksrare-judging

[Evert0x]

I don't think this is a valid issue.

It's the responsibility of the end user to acquire LOOKS at a good price. If the price of LOOKS would exponentially increase the minute before someone needs them, the person is paying the price for their urgent need to acquire LOOKS.

renders the periphery contract useless

The periphery contract is functioning exactly like it's supposed to, as it reflects the market price.

[Oot2k]

Escalate

I think this issue describes the impact of the price manipulation issue differently and thereby should be a valid medium.

The attack idea here is to make the heal swap revert by price manipulation to prevent healing and kill agents.

The difference here to other defi apps is that make a transaction revert can cause financial damage.
Think of following case:
User1 has 100 wounded agents, next round would be the last to heal them before they die.
User1 now waits till right before next round start and calls heal.
Attacker manipulates price.
User1s heal reverts, next round gets called and his agents die.

This attack is quite expensive, but the economical damage can be quite high, hence medium severity.

[sherlock-admin2]

Escalate

I think this issue describes the impact of the price manipulation issue differently and thereby should be a valid medium.

The attack idea here is to make the heal swap revert by price manipulation to prevent healing and kill agents.

The difference here to other defi apps is that make a transaction revert can cause financial damage.
Think of following case:
User1 has 100 wounded agents, next round would be the last to heal them before they die.
User1 now waits till right before next round start and calls heal.
Attacker manipulates price.
User1s heal reverts, next round gets called and his agents die.

This attack is quite expensive, but the economical damage can be quite high, hence medium severity.

You've created a valid escalation!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[nevillehuang]

Hi @Oot2k, thanks for the detailed escalation. Considering the following, I think this is a low/non-issue.

• Given the objective to prevent healing is to win the grand prize (which is not guaranteed), the cost of executing such a price manipulation is not incentivised.

• The recommendation that is Allowing users to heal directly using LOOKS is already possible via Infiltration.heal(). Users can always execute a swap via uniswap themselves where slippage can be applied or simply buy LOOKS off secondary exchanges. This way, heal will never revert due to price manipulation.

I think best is if you can provide a scenario where cost of attack for manipulating this specific pool here to block healing is possibly more profitable for attacker than if he does not, then this finding could be reinstated.

Though I think @0xhiroshi @nasri136 should take a look, happy to hear your thoughts.

[0xhiroshi]

Are we talking about trying to manipulate the price of LOOKS using one's own capital over 2 transactions in the same block?
Can another bot come in to dump LOOKS to the inflated WETH/LOOKS pool before the attacker finishes the attack, after the heal reverts?

[nevillehuang]

@Oot2k could you shed some more specific details on how the price manipulation could be performed?

[Oot2k]

@nevillehuang I agree with your second point raised. The user can indeed call the function on the contract it self without using the periphery contract.
I disagree with your fist point, sherlock rules state that even if attack is expensive / non profitable it still counts as medium.
I also believe even if the user can avoid this, this issue renders the periphery contract useless.

@0xhiroshi
The attack would involve manipulating the price like you said, for example swaping a lot of WETH for LOOKs which would increase the price of LOOKs and make the transaction revert. After the attacker can swap LOOKs back to WETH.
He would use some form of MEV bot to avoid frontrunning.

In the end this is just a basic sandwich attack like all the other reports mention.

Here we just focused on the fact that the damage does not directly come from the price difference, but from the fact that a reverting transaction will cause financial damage by user losing his tokens (not healing).

The likelihood of this happening in real life is depending mainly on the size of price pool. If we assume that the price pool is 425 ETH (like the docs state), and current LOOKs volume does not increase significantly, this attack can become profitable if players with large stake in the game start attacking each other.

To summarize why I think this should be a medium:

• can be profitable if Token Price is high / a lot of participates in game
• renders the periphery contract useless

I don't think there can be done much about this issue -> mainly incurage users to not use swap when stakes are high.

[jpopxfile]

1. Users can swap using another aggregator or router and then heal directly.
2. Even if it fails, user can still heal anytime before the roundstart is called

[nevillehuang]

Hi @Oot2k considering the following I am on the fence of validating this issue as medium severity, but am leaning towards agreeing with you.

So i will state my points here and leave it up to @nasri136 @Evert0x for the final decision:

1. No fix can resolve this issue, unless protocol choose to remove the contract completely. Even if you implement a slippage, price manipulation will still cause heal() to revert.

2. On the other hand, somebody with sufficient funds can indeed potentially cause a permanent DoS of the InfiltrationPeriphery.heal() function assuming their "front-running bot" is capable enough to front-run all healing and they have sufficient capital to do so.

3. Like sponsor mentioned, the workaround is to self obtain LOOKS and perform the swap manually, in which case healing will never revert due to price manipulation.

[Czar102]

Result:
Invalid
Duplicate of #89

Agree with Evert here, the details of the market price should not be considered here. Using a periphery contract to automatically acquire the LOOKS token is the responsibility of the user and is out of scope.

[sherlock-admin2]

Escalations have been resolved successfully!

Escalation status:

• Oot2k: rejected