First Flight #18: T-Swap

Summary

Calculations could be manipulated through direct transfers to the contract, increasing its balance as they depends on these balances.

Vulnerability Details

Calculation poolTokensToWithdraw = (liquidityTokensToBurn * i_poolToken.balanceOf(address(this))) / totalLiquidityTokenSupply() depends on balance and token supply - these values can be manipulated through external calls. Balance dependency: poolTokensToWithdraw = (liquidityTokensToBurn * i_poolToken.balanceOf(address(this))) / totalLiquidityTokenSupply(). Supply dependency: liquidityTokensToMint = (wethToDeposit * totalLiquidityTokenSupply()) / wethReserves

Impact

Tools Used

Slither

Recommendations

Avoid possible manipulations of calculations because of external transfers.