First Flight #18: T-Swap

Summary

The _swap function includes a mechanism that rewards users with 1 token after every 10 swaps. However, the pool does not generate sufficient fees to support this reward distribution. Consequently, this disrupts the core invariant of 𝑥⋅𝑦=𝑘 where 𝑥 and 𝑦 are the reserves of the two assets in the pool, and 𝑘
is a constant product.

Vulnerability Details

The reward mechanism in the _swap function is intended to incentivize user participation by granting 1 token for every 10 swaps executed. However, this implementation results in a depletion of the pool's reserves since the fees generated are insufficient to cover the rewards. This leads to an imbalance in the reserves, thereby breaking the core invariant 𝑥⋅𝑦=𝑘.

Proof of Concept (PoC):

1. Deploy Tswap.

2. Perform 10 swaps to trigger the reward distribution.

3. Observe that the pool's reserves are reduced by 1 token, causing an imbalance and breaking the core invariant.

Impact

1. Invariant Violation: The core invariant 𝑥⋅𝑦=𝑘 is disrupted, leading to potential arbitrage opportunities and loss of value for liquidity providers.

2. Reserve Depletion: The pool's reserves are depleted over time due to the reward mechanism, causing an imbalance in the liquidity pool.

Tools Used

Manual Review

Recommendations

1. Remove Reward Mechanism: Eliminate the reward distribution logic from the _swap function to prevent depletion of the pool's reserves.

2. Sustainable Incentives: Implement a sustainable incentive mechanism that does not disrupt the core invariant. For example, rewards could be funded through an external source or accumulated over a longer period.