First Flight #18: T-Swap

Summary

The pool reward users with 1**18 of one of the tokens every 10 swaps, without taking care of how much was swapped. This can drain the pool if the attacker is just doing small swaps.

Vulnerability Details

The attacker keeps calling the swap function with very low input, every 10 swaps he is rewarded with 1**18 of the output token.

Impact

Pool can be drained of tokens.

Tools Used

Unit test

Recommendations

Instead of rewarding users every 10 swaps, the protocol can reward the users after x amount of poolToken swapped and y amount of weth swapped.
When the x and y reaches predefined value then reward the user.