# Buoy3Pool.safetyCheck is not precise and has some assumptions

Buoy3Pool.safetyCheck only compares a/b and a/c ratios, so b/c can drift up to 2x BASIS_POINTS and inverted ratios pass, letting manipulated Curve ratios halt deposits/withdrawals.

- Payout: Audit contest
- Severity: high
- Program: Gro Protocol
- Found by: cmichel
- Disclosed: 2021-08-30
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-06-gro-findings/issues/104
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-gro%3AH-02
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:oracle-manipulation

**Target:** Buoy3Pool.safetyCheck ratio validation against Curve
**Root cause:** safetyCheck validates only a/b and a/c ratios against BASIS_POINTS; by transitivity b/c can deviate up to 2*BASIS_POINTS, and a/b in range does not imply b/a in range. NatSpec also claims an oracle check that isn't performed.
**Steps:**
1. Read `safetyCheck` in Buoy3Pool: it compares `_ratio` a/b and a/c to `lastRatio` within `BASIS_POINTS`.
2. Note b/c (USDC/USDT) is never checked, so it can be off by up to `2 * BASIS_POINTS`.
3. Note inverted ratio: with `lastRatio = 1.0`, `a=1.0, b=0.8` gives `a/b=1.25` (out of 20% range) but `b/a=0.8` (in range).
4. Manipulate Curve pool ratios so the unchecked b/c or inverted direction passes safetyCheck while true deviation is large.
**How found:** Code review of safetyCheck's ratio math: noticed only two of three pairwise ratios are checked and that ratio checks are direction-dependent, contradicting the NatSpec's oracle claim.
**Exploitation:** Manipulate Curve pool ratios (e.g. via flash loan) so the unchecked b/c pair or inverted ratio direction passes safetyCheck despite large true deviation, causing deposits/withdrawals to revert and forcing emergency mode.
**Insight:** When a safety check compares N assets pairwise, verify all N(N-1)/2 pairs are covered and that the check is symmetric under ratio inversion; transitivity only bounds the unchecked pair to the sum of tolerances.