osmosis icon indicating copy to clipboard operation
osmosis copied to clipboard

[Transmuter][Audit] Resetting change limiters creates an opportunity window for economic attacks

Open iboss-ptk opened this issue 1 year ago • 0 comments

2. Resetting change limiters creates an opportunity window for economic attacks
In contracts/transmuter/src/contract.rs:225-228, the states of all change limiters are reset. This is done during the addition of new assets because weights are no longer correct and should be recalculated.
However, change limiters implement protection from rapid market changes and pool imbalances. Removing them, even temporarily, creates an opportunity window for economic attacks. A malicious party, capable of joining the pool with a large position, can simply listen for on-chain events of the pool, and deploy the attack as soon as new assets are added to the pool.

iboss-ptk avatar Apr 29 '24 07:04 iboss-ptk