First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No slippage protection in `TSwapPool::swapExactOutput` could cause user to pay more in exchange of the specified output token especially when market conditions are turbulent.

soupy

Summary

In TSwapPool::swapExactOutput, there is no input parameter like maxInputAmount that user can specify to enable a slippage protection within the function. This could cause user to pay unexpectedly high amount of input token to exchange for a specified output token

Vulnerability Details

The function TSwapPool::swapExactOutput does not have any input parameter and check to limit the maximum input amount to protect user from paying a high amount of input token unexpectedly when market conditions are turbulent. In comparison to a similar function TSwapPool::swapExactInput, the function does provide slippage protection through minOutputAmount. The protocol should implement the same slippage protection for TSwapPool::swapExactOutput as well by enabling the protection with maxInputAmount

Impact

User could potentially pay an unexpectedly high input amount in exchange for a specified output token especially when market conditions are turbulent

Tools Used

Manual review

Recommendations

Implement slippage protection via maxInputAmount in TSwapPool::swapExactOutput

​
function swapExactOutput(
IERC20 inputToken,
IERC20 outputToken,
uint256 outputAmount,
+ uint256 maxInputAmount,
uint64 deadline
)
public
revertIfZero(outputAmount)
revertIfDeadlinePassed(deadline)
returns (uint256 inputAmount)
{
uint256 inputReserves = inputToken.balanceOf(address(this));
uint256 outputReserves = outputToken.balanceOf(address(this));
​
inputAmount = getInputAmountBasedOnOutput(
outputAmount,
inputReserves,
outputReserves
);
​
+ if (inputAmount > maxInputAmount) {
+ revert TSwapPool__InputTooHigh(inputAmount, maxInputAmount);
+ }
​
_swap(inputToken, inputAmount, outputToken, outputAmount);
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of slippage protection in `TSwapPool::swapExactOutput` causes users to potentially receive way fewer tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.