Part 7: Price Manipulation Upon Reserve-Based Calculations of Pair Prices

Imagine a scenario of a DEX where prices are defined by a trading pair - classic stuff, right?

Prices are calculated using the reserves of the two assets in the pair, which can be altered by calling the mint and burn functions. This design allows for the possibility of price manipulation through a tactic known as a sandwich attack, which can be particularly detrimental if the manipulated prices are utilized in other protocols.

Understanding Sandwich Attacks

A sandwich attack in the context of a DEX involves a malicious actor, or attacker, manipulating the price of an asset by executing trades that 'sandwich' a target transaction. Here’s a step-by-step breakdown:

• Front-Running: The attacker observes a pending transaction from a user intending to buy a significant amount of a particular asset, which is expected to increase the asset’s price.

• Initial Manipulation: Before the user's transaction is mined, the attacker places a buy order for the same asset, increasing its price.

• Exploitation: The user’s transaction is then mined, purchasing the asset at the artificially inflated price.

• Final Manipulation: Immediately after the user's transaction, the attacker sells the asset, causing its price to drop and profiting from the artificially induced price volatility.

Example

In a practical scenario, consider a user intending to purchase a large quantity of Token A using Token B on a DEX. An attacker, observing this pending transaction, could:

• First, purchase Token A, causing its price to rise.

• Allow the user’s transaction to go through, further driving up the price.

• Sell Token A immediately afterward, capitalising on the inflated price and causing it to plummet, to the detriment of the user.

This not only impacts the user but also the integrity of the DEX and any other protocols utilizing the manipulated price for functions like loan collateralization, synthetic asset pricing, or automated portfolio management.

The Fix: Creating a Function to Aggregate Prices

In light of the vulnerability that allows price manipulation through sandwich attacks on the DEX, a focused recommendation would be to develop a function that aggregates prices from multiple sources, thereby diluting the impact of manipulated prices within the DEX itself.

Here are some tips:

• Multiple Price Sources: The function should pull price data from various external sources, such as different DEXs, centralized exchanges, and oracle services, to formulate a more holistic and stable asset price.

• Weighted Averages: Implement a weighted average calculation that considers the liquidity or trading volume of the sources to ensure that prices from more reliable sources have a greater impact on the aggregated price.

• Time Sensitivity: Ensure that the aggregated price is time-sensitive, reflecting recent trades to maintain relevance and accuracy in fast-moving markets.

Now you're safe against price manipulations and sandwich attacks!

Follow Audita Security on X (@AuditaSecurity), LinkedIn (Audita) and Medium (@audita) for safety tips, hack alerts and all things Web3.

Stay safu!
Audita's Team