First Flight #18: T-Swap

Summary

Protocol is not compatible with Fee on Transfer tokens and rebasing tokens. As using that tokens will break the protocol invariant.

Vulnerability Details

TSwap pool uses the balanceOf token everytime to calculate price, without checking the protocol invariant to maintain it's value. Fee on transfer tokens provide less amount to pool while rebasing tokens can do both (increase or decrease balance via rebasing).
If someone donate tokens to pool, they can still manipulate the value of token.

Impact

Incompatible with certain tokens, break the protocol invariant

Tools Used

Manual review

Recommendations

account the balance changes to invariant, so it stay true in all conditions.