Submission Details
Severity:
`TSwapPool::swapExactInput` doesn't specify what value to return, which makes it always return 0
Summary
The TSwapPool::swapExactInput function is expected to return the actual amount of tokens bought by the caller. However, while it declares the named return output, it is never assigned a value, nor uses an explicit return statement.
Impact
The return value will always be 0, giving incorrect information to the caller.
Proof of Code
Include this test in TSwapPool.t.sol:
function testWrongOutputInSwapExactInput() public {
// Liquidity provider adds liquidity to the pool
testDeposit();
uint256 expectedOutput =
pool.getOutputAmountBasedOnInput(1e18, poolToken.balanceOf(address(pool)), weth.balanceOf(address(pool)));
vm.startPrank(user);
poolToken.approve(address(pool), 1e18);
uint256 actualOutput = pool.swapExactInput(poolToken, 1e18, weth, 0, uint64(block.timestamp));
// The expected the return value from swapExactInput isn't the same as the one calculated with
// getOutputAmountBasedOnInput
assert(actualOutput != expectedOutput);
// swapExactInput always returns 0
assertEq(actualOutput, 0);
}
Tools Used
Manual review
Recommendations
Make the following changes to swapExactInput:
returns (
uint256 output
)
{
uint256 inputReserves = inputToken.balanceOf(address(this));
uint256 outputReserves = outputToken.balanceOf(address(this));
- uint256 outputAmount = getOutputAmountBasedOnInput(inputAmount, inputReserves, outputReserves);
+ output = getOutputAmountBasedOnInput(inputAmount, inputReserves, outputReserves);
- if (outputAmount < minOutputAmount) {
- revert TSwapPool__OutputTooLow(outputAmount, minOutputAmount);
+ if (output < minOutputAmount) {
+ revert TSwapPool__OutputTooLow(output, minOutputAmount);
}
- _swap(inputToken, inputAmount, outputToken, outputAmount);
+ _swap(inputToken, inputAmount, outputToken, output);
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Default value returned by TSwapPool::swapExactInput results in incorrect return value given
Rewards breakdown
nSLOC
276This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.