# Singularity V2 Writeups

### Pool drain via Oracle Sandwich Attack

### Description

Pools whose tokens are dropping in value can be drained by an attacker in proportion to the drop in token price.

This attack can only be realized if:
1. The attacker can sandwich Chainlink's updates to its price oracles
2. The attacker already has some of the underlying pool token before the attack
3. The price of the underlying pool token is going down (according to the Chainlink oracle)

The amount that the attacker can drain is dependent on:
1. How much of the underlying pool token the attacker has before the attack
2. How large the price drop is

### Example
Scenario:
Assume there are two singularity pools deployed, one for USDC and one for DAI. Each pool has 10 USDC and 10 DAI in them, and assets are currently equal to liabilities. The Chainlink oracle for each pool is reporting that 1 DAI = $1 and 1 USDC = $1.

The attacker has 1 DAI they will be utilizing in the attack.

Attack:
Chainlink recognizes that the price of 1 DAI has dropped by 1% and queues up a transaction to update the price oracle so 1 DAI = $0.99

Attacker detects the transaction in the mempool & attempts to sandwich the oracle update txn to trigger the following behavior:

-Start of block-
1. (attacker txn) Attacker swaps 1 DAI for 0.999363 USDC using the Singularity router.
2. (oracle update) The price of DAI is adjusted so 1 DAI = $0.99
3. (attacker txn) Attacker swaps 0.999363 USDC for 1.009291253 DAI using the Singularity router.

-End of block-

When the block is mined, the DAI pool's assets will be 9.990487685, reflecting a drain equal to ~1% of the attacker's starting capital.

The attacker will have 1.009291253 DAI. In real terms, according to the oracle, 1.009 DAI at this point is equal to $1. However, since DAI has a target price of $1, it is very likely the oracle will evaluate 1.009 DAI as == $1.009 in the future, enabling the attacker to repeat this attack whenever there is volatility in the DAI price.