Impact of manipulations of the Uniswap pool price

In this section, we discuss the impact of manipulations of the Uniswap pool price by a possible attacker within a single transaction, that is without manipulating the time-weighted average price. Let us denote the two tokens by $X$ and $Y$. We assume that the time-weighted average price is $P$ (this is in units of $\frac{Y}{X}$), and in the positive direction, the onlyCalmPeriods modifier checks that the current price at the time of invocation $p$ satisfies $p\le (1+d)\cdot P$ for some constant $d\ge 0$. We will sketch an attack scenario in which the attacker attempts to use price manipulations in order to steal value from the vault/strategy contracts, and we will attempt to estimate (making some simplifications along the way) under what conditions, in particular what value of $d$, the attacker can make a profit. We assume the price before the attacker begins is $P$ and that the value of the strategy contract's position is $V$ (in units of $Y$).

The attacker takes the following actions with funds of tokens $X$ and $Y$ potentially obtained from a flash loan, and paid back at the end. We will expand on the precise amounts later.

1. They buy a large amount of $X$ in the Uniswap pool with their $Y$, moving the price to $p=(1+d)\cdot P$.

2. They deposit some tokens $X$ into the vault.

3. They sell a large amount of $X$ in the Uniswap pool, moving the price back to $P$.

4. They withdraw their share of the vault.

Step 1: Manipulating the price

To simplify our calculations, we assume that the liquidity provided by the strategy to the Uniswap pool is centered around the tick corresponding to the price $P$, with a very small width, so that we can ignore the price change while trading within that position for the purposes of our estimate. This position, valued $V$ in total, is composed of $X$ and $Y$ so that half of the value is in each of the two tokens, so it consists of $a_Y=\frac{V}{2}$ tokens $Y$ and $a_X=\frac{V}{2\cdot P}$ tokens $X$.

The attackers buying converts the strategy's position entirely to token $Y$, so the attacker will pay $a_Y$ in $Y$ for this and receive $a_X$ in $X$. Beyond that, let us assume that the rest of the liquidity in the Uniswap pool amounts to having to pay $b_Y$ in $Y$ and obtain $b_X$ in $X$ to move the price to $p=(1+d)\cdot P$.

The above was without fees. Let us assume the fee rate for the Uniswap pool is $\gamma$, for example $\gamma =1.0005$ (i.e., 0.05%). Then after Step 1, the attacker has paid $\left(a_Y+b_Y\right)\cdot (1-\gamma {)}^{-1}$ of token $Y$ and received $a_X+b_X$ of token $X$.

Step 2: Depositing tokens

The attacker now deposits $c_X$ tokens $X$. Note that due to this step, we must restrict our price manipulation in such a way as to pass the onlyCalmPeriods check.

The first thing that will happen is that the strategy removes its liquidity. Ignoring the minor amount of fees, this results in the entire value $V$ being returned in the form of token $Y$. The price of the $c_X$ tokens $X$ contributed by the attacker is $c_X\cdot (1+d)\cdot P$. If the total amount of shares before was $T$, then the attacker thus receives $\frac{T\cdot c_X\cdot (1+d)\cdot P}{V}$.

The strategy contract will then provide liquidity to the Uniswap pool around the current price, providing $c_X$ of token $X$ and $V$ of token $Y$.

Step 3: Returning the price to normal

To trade back the price in the Uniswap pool to where it was before, the attacker first needs to trade through the strategy contract's position, which means converting the tokens $Y$ to $X$, at a price of $(1+d)\cdot P$ (we again ignore the price changes due to the width of the position). As the strategy contract's position consisted of $V$ of token $Y$, the attacker must pay $d_X=\frac{V}{(1+d)\cdot P}$ of token $X$ for this without fees, and they receive $V$ of token $Y$ in return.

After that, the attacker has to pay $b_X$ in $X$ and receive $b_Y$ in $Y$, reverting the trade regarding the remaining liquidity in the pool between the prices.

Taking into account Uniswap fees, in total the attacker has to pay $\left(d_X+b_X\right)\cdot (1-\gamma {)}^{-1}$ in $X$ and receives $V+b_Y$ in token $Y$.

Step 4: Withdrawing the shares

When withdrawing the shares, the strategy will first withdraw its liquidity, which amounts to $c_X+d_X$ of token $X$. We can rewrite this as follows.

The attacker holds $\frac{T\cdot c_X\cdot (1+d)\cdot P}{V}$ of a total of $T+\frac{T\cdot c_X\cdot (1+d)\cdot P}{V}$ shares, and so they receive the following amount of tokens $X$. They thus receive the following amount of tokens $X$.

End result for the vault

At the end, the vault is left with only tokens $X$. Let us calculate their worth in terms of token $Y$ in order to compare with the original worth of $V$.

According to the above formula, the vault/strategy contracts lose value, with loss increasing the bigger $d>0$ is. For very small $d$, this loss might be offset by the fees collected during the attack. For the first step, the fees collected will be about $\frac{V}{2}\cdot \frac{\gamma }{1-\gamma }$ in token $Y$. The fees collected when trading back will be about $\frac{V}{(1+d)\cdot P}\cdot \frac{\gamma }{1-\gamma }$ in token $X$. The total worth of the fees is thus, in $Y$,

We can easily check that these results are plausible: the strategy traded its entire value from one token to the other at the unfavorable price of $(1+d)\cdot P$ instead of $P$, so $V_{after}$ is as one would expect. Similarly, fees collected come from trading half of the liquidity at the start, and then the entire liquidity, but at the unfavorable price, so $\frac{1}{2}+\frac{1}{1-d}$ is as expected as well.

Conditions under which the vault makes a loss

For what $d$ will the fees we just estimated offset the loss? For the vault not losing value on this attack, we obtain the following, assuming $\gamma <2/3$:

Let us calculate this for a concrete value for $\gamma$. Uniswap V3 pools can have different fees. A lower fee will be worse for the vault/strategy here, so to be conservative, let us consider a low fee of 0.01%, for which there for example exists a DAI/USDC pool with significant activity. Using this script,

gamma = 0.0001
num = 1 + (gamma / (1-gamma))
denom =  1 - (gamma / 2*(1 - gamma))
result = num/denom - 1
print(result)

we obtain that we must have roughly $d<0.00015$ to not make a loss, amounting to a relative price change from the time-weighted average price of at most 0.015%. It thus might not always be feasible to prevent this kind of attack by choosing $d$ in such a way that the vault/strategy will never make a loss; prevention must hinge on the attacker being unable to make a profit instead (due to having to trade through the rest of the liquidity providers' liquidity as well).

End result for the attacker

Let us calculate the net amount of token $X$ and $Y$ the attacker gained. We obtain the following.

Let us convert the total value to token $Y$. To simplify, we assume that the liquidity in the Uniswap pool was concentrated around the price $P$, so that we can estimate $b_Y=b_X\cdot P$. Then we obtain

We can check plausibility of this formula: the $V\cdot \left(\frac{1}{2}-\frac{1}{(1+d)\cdot (1-\gamma )}+\frac{1-2\gamma }{2\cdot (1-\gamma )}\right)$ part comes from the attacker trading with the strategy's positions. If we set $\gamma =0$, this would be $V\cdot \left(1-\frac{1}{(1+d)}\right)$, which corresponds to buying the strategy's entire balance while only needing to pay $\frac{1}{1+d}$ of the fair price for it, which is exactly what the attack is doing, so this is exactly as we would expect. The occurence of $\gamma$ lowers the value due to losses due to fees. The $b_Y\cdot \frac{2\gamma }{1-\gamma }$ part is then from the fees required to trade through the other liquidity provider's liquidity twice.

Conditions under which the attack is profitable

Given a certain ratio between $V$ and $b_Y$, say $r=V/b_Y$, what values of $d$ allow the attacker to make a profit? We obtain

There are two cases here. If the left-hand side is smaller than or equal to zero, then the attacker will not make a profit no matter what $d$ is. Otherwise we get

Examples for profitability

Using the above formulas, we arrive at the following table for when the attack will be profitable.

We can see that, for example, for a reasonable ratio of 1%, and a fee of 0.01% ($\gamma =0.0001$), a value of $d\ge 2.06$% suffices to make the attack profitable.

Code used to generate the profitability table

The following Sage code was used to generate the table above.

def lhs(gamma, r):
  a = 1/2
  b = (1 - 2*gamma) / (2 - 2*gamma)
  c = (r**(-1)) * ((2*gamma) / (1 - gamma))
  inner = a + b - c
  outer = (1 - gamma) * inner
  return outer

def calc(gamma, r):
  return (lhs(gamma, r)**(-1)) - 1

print('| `l!$\gamma$` | `l!$r$` | requirement for `l!$d$` |')
print('| --- | --- | --- |')
for gamma in (0.0001, 0.001, 0.01):
  for r in (1, 0.1, 0.01, 0.001):
    if lhs(gamma, r) <= 0:
      result = 'not possible'
    else:
      result = f'`l!$d \geq {float(calc(gamma, r)*100):.2f}$`%'
    print(f'| `l!${float(gamma)}$` | `l!${float(r)}$` | {result}  |')

Disclaimer

The above estimates are a best effort based on simplifying assumptions (such as ticks being continuous real numbers rather than discrete, tick spacing and position width infinitesimal, etc.), so the numbers obtained may not be precise boundaries that are safe.