First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`TSwapPool::sellPoolTokens` mismatches input and output tokens causing users to receive the incorrect amount of tokens

coffee

Summary

The sellPoolTokens function is intended to allow users to sell pool tokens in exchange for WETH. Users input how many pool tokens they want to sell in the poolTokenAmount parameter. However, the function currently miscalculates the swapped amount.

This is because the swapExactOutput function is called, whereas the swapExactInput function is the one that should be called. Because users specify the amount of input tokens, not output tokens.

Vulnerability Details

Users will swap the wrong amount of tokens, this is unintended for what the user wants.

Impact

The test below fails showing that the user does not receive the expected amount of WETH back

function testSellPoolTokensFunction() public {
vm.startPrank(liquidityProvider);
weth.approve(address(pool), 100e18);
poolToken.approve(address(pool), 100e18);
pool.deposit(100e18, 100e18, 100e18, uint64(block.timestamp));
vm.stopPrank();
​
vm.startPrank(user);
poolToken.approve(address(pool), 10e18);
uint256 expected = 9e18;
pool.sellPoolTokens(10e18);
assert(weth.balanceOf(user) >= expected);
}

Tools Used

--Foundry

Recommendations

It is recommended to use the swapExactInput function instead of the swapExactOutput function. This will also require changing the sellPoolTokens function to accept a new parameter.

function sellPoolTokens(
uint256 poolTokenAmount,
+ uint256 minWethToReceive,
) external returns (uint256 wethAmount) {
- return swapExactOutput(i_poolToken, i_wethToken, poolTokenAmount, uint64(block.timestamp));
+ return swapExactInput(i_poolToken, poolTokenAmount, i_wethToken, minWethToReceive, uint64(block.timestamp));
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`sellPoolTokens` mismatches input and output tokens causing users to receive the incorrect amount of tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.