First Flight #18: T-Swap

Summary

To get reserves in the pool, the Pool contract uses direct access mechanism instead of internal accounting.

Vulnerability Details

To get reserves in the pool, the Pool contract uses direct access mechanism instead of internal accounting.
For example, in the getPoolTokensToDepositBasedOnWeth function

Malicious actor can directly send weth, or pool token to the contract address to manipulate price because price determines based on reserved amounts of two tokens.

Impact

Malicious actor can steal users' funds or Protocol's revenue by manipulating price using donation attack.

Tools Used

Manual review

Recommendations

Recommend using internal accounting in the Pool contract.
Like uniswap, create reserve storage slots for weth, and pool token, and update those for each deposit and withdraw transaction.