[Audit_RV]Vulnerability: Adding liquidity could be disabled using relative small amount of asset by manipulating the pool price of the stable coin

[yanliu18]

When add liquidity, the tvl of an asset is vulnerable to stable coin price manipulation, since the preferred stable coin is a tradable asset in the pool and tvl is calculated using the spot price in Omnipool. Thus, it can be utilised by the attacker to disable the adding liquidity operation using relative small amount of chosen asset.

Description

https://github.com/galacticcouncil/HydraDX-node/blob/16cdbcf25ef2f1dac5c3569d8cd44cc028ec4076/pallets/omnipool/src/lib.rs#L622

where the asset tvl after the operation is computed in Math::calculate_add_liquidity_state_changes() as follows:

let adjusted_asset_tvl_hp = if is_stable_asset {
        stable_reserve_hp.checked_add(amount_hp)?
    } else {
        stable_reserve_hp
            .checked_mul(hub_reserve_hp.checked_add(delta_hub_reserve_hp)?)
            .and_then(|v| v.checked_div(stable_hub_reserve_hp))?
    };

where price_stable_coin = stable_hub_reserve_hp/ stable_reserv_hp which is the current price of the stable coin. Adding liquidity when a significant price drop (either by observing the state or price manipulation) of the stable coin happened could let the LP add more tvl of the asset than it should be, resulting the TotalTVL to reach TVLCap earlier than it should be. This could be exploited as an attack to disable adding liquidity to the pool using relative little amount of asset.