First Flight #18: T-Swap

Summary

The function getInputAmountBasedOnOutput is multiplying by 10000 but instead it should be 1000.

Vulnerability Details

Wrong math.

Impact

Users pay more output token when doing swap using swapExactOutput.

Tools Used

Reading the code.

Recommendations

Fix the formula

function getInputAmountBasedOnOutput(
uint256 outputAmount,
uint256 inputReserves,
uint256 outputReserves
)
public
pure
revertIfZero(outputAmount)
revertIfZero(outputReserves)
returns (uint256 inputAmount)
{
return
((inputReserves * outputAmount) * 1000) / // <<< here the multiplication should be 1000 instead of 10000
((outputReserves - outputAmount) * 997);
}