feat: Flash loan attack surface detection rule (CP-120) for price oracle manipulation

[Nanle-code]

Overview

Flash loan attacks have been responsible for hundreds of millions in losses across DeFi. The core vulnerability pattern involves a contract reading a price or value from an on-chain AMM spot price within the same transaction that a flash loan is active — making the price trivially manipulable by the attacker.

Problem

// Vulnerable: reading Uniswap spot price directly
function getPrice(address token) public view returns (uint256) {
    (uint112 reserve0, uint112 reserve1,) = IUniswapV2Pair(pair).getReserves();
    return reserve1 * 1e18 / reserve0; // spot price, manipulable via flash loan
}

function borrow(uint256 amount) external {
    uint256 collateralValue = getPrice(collateralToken) * collateralBalance;
    require(collateralValue >= amount * 150 / 100, "undercollateralized");
    // attacker: flash loan to pump price, borrow far more than they should
}

Proposed Rule: CP-120

Detection heuristics:

1. Spot price read pattern — detect calls to .getReserves() on Uniswap V2 pair interfaces followed by arithmetic division/multiplication used as a price feed within the same function
2. Single-block TWAP absence — flag getReserves() usage without a corresponding TWAP calculation (absence of block timestamp delta logic)
3. Chainlink oracle absence — if a contract has a getPrice / latestRoundData pattern that does NOT call a Chainlink AggregatorV3Interface, flag it as a potential centralized or manipulable oracle
4. Same-function flash loan + valuation — detect if a contract implements a flashLoan callback (e.g. onFlashLoan, uniswapV2Call) and also performs asset valuation in the same execution context

Severity

Critical — flash loan price manipulation has a near-100% exploit success rate if detected

Acceptance Criteria

• CP-120 rule implemented in packages/core/src/rules/cp120-flash-loan.ts
• Detects getReserves()-based spot price reads in lending/valuation functions
• Flags absence of TWAP protection when spot price is used as oracle
• Detects flash loan callback implementations that perform price-sensitive operations
• Severity: Critical for direct exploit path, High for missing TWAP
• Example vulnerable contract added to examples/contracts/

References

• bZx Flash Loan Attack (2020)
• Uniswap V2 TWAP Documentation
• Chainlink Best Practices