First Flight #18: T-Swap

Summary

The sellPoolTokens function is currently utilizing swapExactOutput instead of swapExactInput to execute token swaps. This incorrect usage can lead to unpredictable and potentially disadvantageous outcomes for users, as it does not allow for precise control over the amount of input tokens required for the swap.

Vulnerability Details

The sellPoolTokens function should allow users to specify the exact amount of pool tokens they wish to sell, and in return, receive an estimated amount of the desired output token. By using swapExactOutput, the function requires the exact output amount to be specified, which can result in users needing to provide an unpredictable and potentially large amount of input tokens. This approach is less user-friendly and can expose users to higher risks due to slippage and price fluctuations.

Impact

1. User Confusion: Users may be confused or misled about the amount of input tokens required, leading to potential dissatisfaction and reduced user trust.

2. Slippage Risk: Users are exposed to higher slippage risk as they cannot accurately predict the amount of input tokens needed for the specified output.

3. Potential Overpayment: Users might overpay in terms of input tokens to achieve the desired output, resulting in financial loss.

Tools Used

Manual Review

Recommendations

1. Use swapExactInput: Modify the sellPoolTokens function to use swapExactInput, allowing users to specify the exact amount of input tokens they wish to sell and receive an estimated amount of the desired output token.

2. Improve User Control: Ensure that users have precise control over their input amounts, minimizing the risk of overpayment and slippage.