First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of slippage protection in TSwapPool::swapExactOutput causes users to potentially receive way fewer tokens

mujahideth

Summary

The user could get a much worse swap if market conditions change before the transaction processes.

Vulnerability Details

The swapExactOutput function does not include any slippage protection. This function is similar to what is done in TSwapPool::swapExactInput, where the function specifies a minOutputAmount, the swapExactOutput function should specify a maxInputAmount
POC:

1-The price of 1 WETH right now is 1,000 USDC
2-The user inputs a swapExactOutput looking for 1 WETH
3-inputToken = USDC
outputToken = WETH
outputAmount = 1
deadline = whatever
4-The function does not offer a maxInput amount
As the transaction is pending in the mempool, the market changes! And the price moves HUGE -> 1 WETH is now 10,000 USDC. 10x more than the user expected
5-The transaction completes, but the user sent the protocol 10,000 USDC instead of the expected 1,000 USDC
​

Impact

The user could get a much worse swap if market conditions change before the transaction processes.

Tools Used

Manual review

Recommendations

We should include a maxInputAmount so the user only has to spend up to a specific amount, and can predict how much they will spend on the protocol.

function swapExactOutput(
IERC20 inputToken,
+ uint256 maxInputAmount,
.
.
.
inputAmount = getInputAmountBasedOnOutput(outputAmount, inputReserves, outputReserves);
+ if(inputAmount > maxInputAmount){
+ revert();
+ }
_swap(inputToken, inputAmount, outputToken, outputAmount);
Updates

Appeal created

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of slippage protection in `TSwapPool::swapExactOutput` causes users to potentially receive way fewer tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.