CG-001 · Potential oracle takeover leading to over-borrowing

CG-001CriticalSupportedStrongly supported

81%

Potential oracle takeover leading to over-borrowing

An unprotected price-source setter lets any caller point SpotPriceOracle at a pool they control. LendingVault then values collateral at the attacker-chosen price and lends against it.

Dependency Break point

01 · Attacker action

Deploy a malicious pool

IPool.getReserves()

02 · VulnerabilityENTRY

Replace the oracle price source

SpotPriceOracle.setPool()

03 · State changeENTRY

`pool` now points to the attacker contract

SpotPriceOracle.setPool()

04 · Attacker action

Deposit nominal collateral

LendingVault.depositCollateral()

05 · External dependency

Oracle returns an inflated spot price

SpotPriceOracle.getPrice()

06 · Contract function

Collateral valued at the manipulated price

LendingVault.collateralValue()

07 · Vulnerability

Borrow limit inflated beyond real collateral

LendingVault.borrow()

08 · Impact

Vault debt-token liquidity drained

LendingVault.borrow()

Break point 1

Restrict setPool to the owner

Break point 2

Use a manipulation-resistant price

Break point 3

Bound oracle input in the vault

Step 1 · Attacker action

Deploy a malicious pool

IPool.getReserves() · contracts/IPool.sol:L5

What happens: Attacker deploys a contract whose getReserves() returns an arbitrary reserveDebt / reserveCollateral ratio.
Why it is included: getPrice() trusts whichever IPool implementation is configured; the interface places no constraints on returned values.
Assumptions: Arbitrary contract deployment is unrestricted on the target chain.
Step confidence: 72%

Supporting evidence

contracts/IPool.sol

line 5

1// SPDX-License-Identifier: MIT
2pragma solidity ^0.8.20;
3 
4interface IPool {
5    function getReserves() external view returns (uint112 reserveCollateral, uint112 reserveDebt);
6}
7

How to break the chain

Impact

An attacker could borrow up to the vault’s entire debt-token balance against a nominal ETH deposit, leaving the protocol with unrecoverable bad debt.

Assets at risk

LendingVault debt-token balance

Preconditions

Attacker can deploy a contract implementing IPool.getReserves().
Attacker holds a small amount of ETH to deposit as collateral.
LendingVault holds debt-token liquidity.

Why this confidence

Chain confidence 81%, derived from validation checks rather than model certainty.

Source code located for every step
Referenced contracts and functions exist
Call graph links LendingVault → SpotPriceOraclecollateralValue → getPrice
State dependency confirmed`pool` written by setPool, read by getPrice
Static detector flags the core issueOnly missing-zero-check fired on setPool; no detector reports the missing access control directly.
Runtime exploit confirmedNo transaction simulation was performed.

Assumptions & limitations