Sudden price fluctuations occuring at a call to _update() will not be reflected by reserves(), sampleReserves() and sampleSupply() until after periodSize seconds

Lines of code Vulnerability details Impact Consider the situation where a token suddenly drops drastically in price in the market. Consider a call to BaseV1Pair.swap which makes a very large swap between the two tokens accurately reflecting the change in price and also causes a new observation to...

Oracle periodSize is very low allowing the TWAP price to be easily manipulated

Lines of code Vulnerability details Impact TWAP oracle easily manipulated Proof of Concept periodSize is set to 0 meaning that the oracle will take a new observation every single block, which would allow an attacker to easily flood the TWAP oracle and manipulate the price Tools Used Recommended...