First Flight #18: T-Swap

First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

Users can receive fewer token due to lack of slippage protection in `TSwapPool::swapExactOutput`

Summary

TSwapPool::swapExactOutput lacks slippage protection.

Vulnerability Details

Lines 335-356

Impact

Market fluctuations prior to any transactions can cause the user to get a much worse swap than expected

Tools Used

Manual review

Recommendations

Modify swapExactOutput by adding maxInputAmount as follows:

function swapExactOutput(
IERC20 inputToken,
+ uint256 maxInputAmount,
.
.
.
inputAmount = getInputAmountBasedOnOutput(outputAmount, inputReserves, outputReserves);
+ if(inputAmount > maxInputAmount){
+ revert();
+ }
_swap(inputToken, inputAmount, outputToken, outputAmount);

This limits how much the user can spend.

Updates

Appeal created

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of slippage protection in `TSwapPool::swapExactOutput` causes users to potentially receive way fewer tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.