First Flight #18: T-Swap

Description:

The sellPoolTokens function is intended to allow users to easily sell pool tokens and receive WETH in exchange. Users indicate how many pool tokens they're willing to sell in the poolTokenAmount parameter. However, the function currently miscalculaes the swapped amount.

This is due to the fact that the swapExactOutput function is called, whereas the swapExactInput function is the one that should be called. Because users specify the exact amount of input tokens, not output.

Impact:

Users will swap the wrong amount of tokens, which is a severe disruption of protcol functionality.

Proof of Concept:

Proof of Concept:

1. Setup Environment: Deploy the TSwapPool contract along with a mock WETH token contract and a pool token contract on a test blockchain (e.g., Ganache).

2. Initial State: Assume the user has 1000 pool tokens and the current exchange rate in the TSwapPool contract would ideally allow for swapping these for 50 WETH.

3. Perform Swap with Current Implementation:

   • The user calls sellPoolTokens with 1000 pool tokens expecting to receive 50 WETH.

   • Due to the use of swapExactOutput, the contract calculates the amount of WETH to send based on an incorrect assumption about the desired output amount, leading to the user receiving an incorrect amount of WETH (e.g., 45 WETH instead of 50 WETH).

4. Analysis:

   • By reviewing the transaction details, it's evident that the amount of WETH received by the user does not match the expected amount based on the input pool tokens.

   • This discrepancy confirms that the sellPoolTokens function does not handle the token swap as intended, causing users to receive less value than expected.

5. Conclusion:

   • The proof of concept demonstrates that the original implementation of sellPoolTokens causes users to receive an incorrect amount of WETH due to the misuse of swapExactOutput.

Recommended Mitigation:

Consider changing the implementation to use swapExactInput instead of swapExactOutput. Note that this would also require changing the sellPoolTokens function to accept a new parameter (ie minWethToReceive to be passed to swapExactInput)