First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Mismatch Handling of outputAmount in TSwapPool::getInputAmountBasedOnOutput Risks Failed Token Swapping

chaossr

Summary

The getInputAmountBasedOnOutput function in the TSwapPool contract does not properly handle cases where outputAmount exceeds outputReserves, leading to unexpected behavior during token swaps.

Vulnerability Details

The getInputAmountBasedOnOutput function is designed to calculate the required inputAmount based on outputAmount, inputReserves, and outputReserves. However, it lacks proper validation to ensure that outputAmount does not exceed outputReserves. This oversight can result in incorrect calculations and potential loss of tokens during swaps.

Impact

The lack of validation in getInputAmountBasedOnOutput to check outputAmount against outputReserves may lead to unintended behavior where transactions are reverted due to incorrect input parameters. This oversight could result in failed token swap attempts, affecting user experience and potentially disrupting transaction flow within the protocol.

POC

function test_getInputAmountBasedOnOutput_outputAmountBiggerThanOutputReserve() public {
uint256 OutputReserve = 1000;
uint256 inputReserve = 1000;
uint256 outputAmount = 1001;
// Expecting a revert due to outputAmount exceeding outputReserve
expectRevert("TSwapPool__OutputTooHigh", function () {
pool.getInputAmountBasedOnOutput(outputAmount, inputReserve, OutputReserve);
});
}
​

Tools Used

Manual code review

Recommendations

function getInputAmountBasedOnOutput(
uint256 outputAmount,
uint256 inputReserves,
uint256 outputReserves
)
public
pure
revertIfZero(outputAmount)
revertIfZero(outputReserves)
returns (uint256 inputAmount)
{
require(inputReserves > 0, "Input reserves must be greater than zero");
require(outputReserves > outputAmount, "Output reserves must be greater than output amount");
​
return ((inputReserves * outputAmount) * 1000) /
((outputReserves - outputAmount) * 997);
}
​
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.