Submission Details
Severity:
Users can receive fewer token due to lack of slippage protection in `TSwapPool::swapExactOutput`
Summary
TSwapPool::swapExactOutput lacks slippage protection.
Vulnerability Details
Lines 335-356
Impact
Market fluctuations prior to any transactions can cause the user to get a much worse swap than expected
Tools Used
Manual review
Recommendations
Modify swapExactOutput by adding maxInputAmount as follows:
function swapExactOutput(
IERC20 inputToken,
+ uint256 maxInputAmount,
.
.
.
inputAmount = getInputAmountBasedOnOutput(outputAmount, inputReserves, outputReserves);
+ if(inputAmount > maxInputAmount){
+ revert();
+ }
_swap(inputToken, inputAmount, outputToken, outputAmount);
This limits how much the user can spend.
Updates
Appeal created
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Lack of slippage protection in `TSwapPool::swapExactOutput` causes users to potentially receive way fewer tokens
Rewards breakdown
nSLOC
276This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.