First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Mismatch of Input and Output Tokens in TSwapPool::sellPoolTokens Causes Incorrect Token Amounts for Users

waydou

Summary

TSwapPool::sellPoolTokens mismatches input and output tokens causing users to receive the incorrect amount of tokens

Vulnerability Details

The sellPoolTokens function is designed to let users sell pool tokens and receive WETH in return. Users specify the number of pool tokens they want to sell using the poolTokenAmount parameter. However, the function currently miscalculates the swapped amount due to calling swapExactOutput instead of swapExactInput. Users specify the exact amount of input tokens, so the swapExactInput function should be used instead.

function sellPoolTokens(
uint256 poolTokenAmount
) external returns (uint256 wethAmount) {
return
swapExactOutput(
i_poolToken,
i_wethToken,
poolTokenAmount,
uint64(block.timestamp)
);
}

Impact

Users will end up swapping incorrect amounts of tokens, causing a significant disruption in the protocol's functionality.

Tools Used

Manual Review

Recommendations

Change the implementation to use swapExactInput instead of swapExactOutput. This also requires modifying the sellPoolTokens function to accept a new parameter, such as minWethToReceive, which will be passed to swapExactInput.

function sellPoolTokens(
uint256 poolTokenAmount,
+ uint256 minWethToReceive,
) external returns (uint256 wethAmount) {
- return swapExactOutput(i_poolToken, i_wethToken, poolTokenAmount, uint64(block.timestamp));
+ return swapExactInput(i_poolToken, poolTokenAmount, i_wethToken, minWethToReceive, uint64(block.timestamp));
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`sellPoolTokens` mismatches input and output tokens causing users to receive the incorrect amount of tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.