First Flight #18: T-Swap

Summary

TSWAP protocol relies on maintaining a constant product invariant for its liquidity pools. The invariant formula, 𝑥⋅𝑦=𝑘 , where
𝑥 and 𝑦 are the reserves of two tokens in the pool, ensures balanced trading and liquidity provision. Tokens that implement a fee on transfer mechanism can disrupt this invariant, leading to potential issues within the protocol.

Vulnerability Details

Fee on transfer tokens impose a fee whenever they are transferred between addresses. This means that the amount of tokens sent is not equal to the amount of tokens received. When such tokens are used within TSWAP pools, the constant product invariant x⋅y=k no longer holds due to the reduced token amount post-transfer.

For example, if a token with a 1% transfer fee is involved, transferring 100 tokens will result in only 99 tokens being received. This discrepancy breaks the TSWAP invariant, causing the liquidity pool to miscalculate reserves and leading to imbalanced pools.

Impact

Incorrect Pricing: The pool will miscalculate token prices due to incorrect reserve balances, leading to potentially unfair trades and arbitrage opportunities.

Liquidity Provider Losses: Liquidity providers might incur unexpected losses as their share of the pool's value can decrease due to the miscalculation.

Proof of Concept (PoC):

1. Deploy a token contract implementing a fee on transfer mechanism (e.g., a 1% fee on each transfer).

2. Create a TSWAP liquidity pool with this token and another standard token.

3. Perform a swap on TSWAP involving the fee on transfer token.

4. Observe the incorrect pricing and reserve imbalance in the pool due to the fee deducted during the token transfer.

Tools Used

Manual Review

Recommendations

Token Compatibility Check: Ensure that tokens added to Tswap pools do not implement a fee on transfer mechanism.