First Flight #18: T-Swap

Summary

t-swap does not support rebase token

Vulnerability Details

In T-Swap, we will use the balanceOf() to calculate the share, or swap amount. The vulnerability is that the balanceOf() for rebase token can change without desposit/withdraw/swap operations.
The core Invariant x * y = k will be broken.

Impact

The core Invariant x * y = k will be broken. k may increase or decrease without any operation in t-swap. This will cause all operations into a mess.
In readme, Our system works because the ratio of Token A & WETH will always stay the same.
Actually, this assumption will be broken for rebase token

Tools Used

Manual

Recommendations

Add one blacklist to the rebase token.