First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

TSwapPool::sellPoolTokens mismatches input and output tokens causing users to receive the incorrect amount of tokens

chaossr

Summary

The TSwapPool::sellPoolTokens function incorrectly swaps pool tokens for WETH, resulting in users receiving an incorrect amount of tokens. This issue arises because the function calls swapExactOutput instead of swapExactInput, leading to a mismatch in the token amounts swapped.

Vulnerability Details

The sellPoolTokens function is designed for users to sell a specified amount of pool tokens and receive WETH in return. Users indicate the amount of pool tokens to sell via the poolTokenAmount parameter. However, the function currently calls swapExactOutput instead of swapExactInput. Since users specify the exact amount of input tokens (pool tokens), the function should be calling swapExactInput to correctly calculate the WETH amount received.
Current implementation:

function sellPoolTokens(
uint256 poolTokenAmount
) external returns (uint256 wethAmount) {
return swapExactOutput(i_poolToken, i_wethToken, poolTokenAmount, uint64(block.timestamp));
}

Impact

Users will receive an incorrect amount of WETH when selling their pool tokens, disrupting the protocol's functionality and causing potential financial loss.

Tools Used

Manual code review

Recommendations

function sellPoolTokens(
uint256 poolTokenAmount
) external returns (uint256 wethAmount) {
return
++ swapExactInput(
i_poolToken,
i_wethToken,
poolTokenAmount,
uint64(block.timestamp)
);
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`sellPoolTokens` mismatches input and output tokens causing users to receive the incorrect amount of tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.