First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect fee calculation in `TSwapPool::getInputAmountBasedOnOutput` the protocol takes too many tokens from users, resulting in lost fees

coffee

Summary

The getInputAmountBasedOnOutput function calculates the amount of tokens a user should deposit given an amount of output tokens. However, the function currently miscalculates the amount. When calculating the fee, it multiplies the amount by 10,000 instead of 1,000.

Vulnerability Details

This means that the protocol takes more fees than expected from users, as per the documentation. Anytime the swap happens, the fees would be wrong.

Impact

The test below shows that the getInputAmountBasedOnOutput function does not return the expected value, the precision is off by a decimal place.

function testGetInputAmountBasedOnOutputWrongFee() public {
vm.startPrank(liquidityProvider);
weth.approve(address(pool), 100e18);
poolToken.approve(address(pool), 100e18);
pool.deposit(100e18, 100e18, 100e18, uint64(block.timestamp));
​
assertEq(pool.getInputAmountBasedOnOutput(100e18, 500e18, 800e18), 71643501934374552228);
​
//Expected value: 71643501934374552228
​
//Actual return value: 716435019343745522281
}

Tools Used

--Foundry

Recommendations

It is recommended to change the value ingetInputAmountBasedOnOutput from 10,000 to 1,000

function getInputAmountBasedOnOutput(
uint256 outputAmount,
uint256 inputReserves,
uint256 outputReserves
)
public
pure
revertIfZero(outputAmount)
revertIfZero(outputReserves)
returns (uint256 inputAmount)
{
- return ((inputReserves * outputAmount) * 10_000) / ((outputReserves - outputAmount) * 997);
+ return ((inputReserves * outputAmount) * 1_000) / ((outputReserves - outputAmount) * 997);
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect fee calculation in TSwapPool::getInputAmountBasedOnOutput causes protocol to take too many tokens from users, resulting in lost fees

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.