The Standard

Summary

Wrong variable used to calculate minimumAmountOut that make swap hard to success

Vulnerability Details

In SmartVaultV3#swap() function, minimumAmountOut is calculated as below:

function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
    uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
    address inToken = getSwapAddressFor(_inToken);
    uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);   // <---------------
    ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
            tokenIn: inToken,
            tokenOut: getSwapAddressFor(_outToken),
            fee: 3000,
            recipient: address(this),
            deadline: block.timestamp,
            amountIn: _amount - swapFee,                                                 // <----------------
            amountOutMinimum: minimumAmountOut,
            sqrtPriceLimitX96: 0
        });
        .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .
}

It can be seen that actual amount that will be swapped is _amount - swapFee, but minumumAmountOut is calculated by _amount. It will make user`s swap hard to success

Impact

User's swap will become harder to success.

Tools Used

Manual review

Recommendations

minimumAmountOut should be calculated as below:

     -  uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
     +  uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount - swapFee);