The Standard

Summary

The amount input used to compute minimumAmountOut in SmartVaultV3::calculateMinimumAmountOut() is different from amountIn used in SmartVaultV3::swap(). This leads to users losing funds when swapping tokens.

Vulnerability Details

To swap tokens, users call the SmartVaultV3::swap function. In this function, the minimum amount is calculated based on the amount they want to swap (_amount). Then the parameters (params) are set to executeNativeSwapAndFee/executeERC20SwapAndFee. params.amountIn is set to the amount the users want to swap minus the swap fee.

Here's the issue :

The _amount argument passed to the smartVaultV3::calculateMinimumAmountOut function is used entirely to calculate the minimum amount of _outToken output that the user should get.
This function is called in the SmartVaultV3::swap function where the input amount used in params.amountIn contains the swap fee as well as the actual amount that will be swapped.

So, the smartVaultV3::calculateMinimumAmountOut function uses _amount as the input amount to calculate the minimum output amount.

But in the SmartVaultV3::swap function, params.amountIn = _amount - swapFee.

As a result, the actual amount in is less than the amount users want to swap, and so the actual amount out will be less than the minimumAmountOut from smartVaultV3::calculateMinimumAmountOut(). This causes users to lose funds during swaps.

Impact

Users lose funds during swaps.

Tools Used

Manual review

Recommendations

Short term :
Use _amount - swapFee instead of _amount in SmartVaultV3::calculateMinimumAmountOut().

Long term :
Properly define the amount to pass in SmartVaultV3::calculateMinimumAmountOut() and the amount to use in params.amountIn in the SmartVaultV3::swap() function.
Return the output amount after the swap been executed and revert whether the returned value is at below the minimumAmountOut or not.