Usage of slot 0 to get sqrtPriceLimitX96 can be easily manipulated

[howlbot-integration]

Lines of code

https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/core/KatanaV3Pool.sol#L43

Vulnerability details

The sqrtPriceX96 is derived from `slot0(), which can be easily manipulate.

struct Slot0 {
// the current price
uint160 sqrtPriceX96;
// the current tick
int24 tick;
// the most-recently updated index of the observations array
uint16 observationIndex;
// the current maximum number of observations that are being stored
uint16 observationCardinality;
// the next maximum number of observations to store, triggered in observations.write
uint16 observationCardinalityNext;
// the numerator of the current protocol fee which is a ratio of the swap fee
uint8 feeProtocolNum;
// the denominator of the current protocol fee which is a ratio of the swap fee
uint8 feeProtocolDen;
// whether the pool is locked
bool unlocked;
}

This report below inspired this bug report and it is similar to this situatiom
Example: https://solodit.cyfrin.io/issues/h-02-use-of-slot0-to-get-sqrtpricelimitx96-can-lead-to-price-manipulation-code4rena-maia-dao-ecosystem-maia-dao-ecosystem-git

Recommended Mitigation Steps

Use the TWAP function to get the value of sqrtPriceX96.

Assessed type

Oracle

[nevillehuang]

Likely invalid and OOS per contest details. This is likely a known uniswapv3 issue

All public known issues, including public audit reports of Uniswap V3 that affect Katana V3

Many issues lack sufficient description of the issue as well, e.g. #validation-178, #validation-47

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid