First Flight #18: T-Swap

Summary

TSwapPool.sol have this bizzare transfer at 10 swap (max swaps)

    if (swap_count >= SWAP_COUNT_MAX) {
        swap_count = 0;
        outputToken.safeTransfer(msg.sender, 1_000_000_000_000_000_000);
    }

Vulnerability Details

    if (swap_count >= SWAP_COUNT_MAX) {
        swap_count = 0;
        outputToken.safeTransfer(msg.sender, 1_000_000_000_000_000_000);
    }

Try to reset some token swaps counter and transfer big amount of tokens.

Impact

Can cripple the app by giving funds to users on deterministic occasions like in ponzy game.

Tools Used

slitehr, code review

Recommendations

Delete those lines.