Submission Details
Severity:
Incorrect calculation in getInputAmountBasedOnOutput
Summary
Incorrect calculation in getInputAmountBasedOnOutput()
Vulnerability Details
In getInputAmountBasedOnOutput(), we will calculate the input amount based on the exact output. The vulnerability is that the calculation is wrong, should be 1000, not 10000.
function getInputAmountBasedOnOutput(
uint256 outputAmount,
uint256 inputReserves,
uint256 outputReserves
)
public
pure
revertIfZero(outputAmount)
revertIfZero(outputReserves)
returns (uint256 inputAmount)
{
return
// @audit should be 1000
((inputReserves * outputAmount) * 10000) /
((outputReserves - outputAmount) * 997);
}
Impact
Users have to pay more input amount than expected. If users set the proper slippage, this transaction is quite probable to be reverted.
Tools Used
Manual
Recommendations
Revisit the calculation , change 10000 to 1000.
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Incorrect fee calculation in TSwapPool::getInputAmountBasedOnOutput causes protocol to take too many tokens from users, resulting in lost fees
Rewards breakdown
nSLOC
276This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.