First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Check for inputReserves in getOutputAmountBasedOnInput Function Can Result in Incorrect Calculation

chaossr

Summary

The getOutputAmountBasedOnInput function does not validate the inputReserves parameter, leading to potential errors if it is set to zero. This oversight affects the accuracy of calculations dependent on this function.

Vulnerability Details

The getOutputAmountBasedOnInput function calculates outputAmount based on inputAmount, inputReserves, and outputReserves. However, it lacks a check for inputReserves, allowing it to be set to zero. This causes the function to return zero, which can lead to incorrect or unexpected behavior downstream in functions that rely on its output.

Impact

f inputReserves is set to zero, any calculations relying on getOutputAmountBasedOnInput will produce incorrect results, potentially causing transactions to revert or proceed with unexpected values. This can disrupt the intended operation of functions like swapExactInput, leading to protocol instability or failures.

##POC

function testgetInputAmountBasedOnOutput_inputReservesEqualZero() public {
uint256 OutputReserve = 1000;
uint256 inputReserve = 0;
uint256 inputAmount = 100;
uint256 amountBasedOnOutput = pool.getInputAmountBasedOnOutput(inputAmount,inputReserve,OutputReserve);
assertEq(amountBasedOnOutput, 0);
}

Tools Used

Manual code review

Recommendations

Implement a check in getOutputAmountBasedOnInput to ensure inputReserves is greater than zero before performing calculations. This check will prevent the function from returning zero unexpectedly and will help maintain the integrity of calculations throughout the protocol.
"I know that there is no impact but i knew that after i write it"

Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.