First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of slippage protection in `TswapPool::swapExactOutput` casues users to potentially receive way fewer tokens

paprikrumplikas

Summary

TSwapPool::swapExactOutput does not include proper slippage protection.

Vulnerability Details

The function swapExactOutput does not include any kind of slippage protection. This function is similar to what is done in TSwapPool::swapExactInput, where the function specifies the minOutputAmount. Similarly, swapExactOutput should specify a maxInputAmount.

Impact

If the market conditions change before the transaction process, the user could get a much worse swap then expected.

Tools Used

Foundry, manual review.

  1. The price of WETH is 1_000 USDC.

  2. User calls swapExactOutput, looking for 1 WETH with the following parameters:

    • inputToken: USDC

    • outputToken: WETH

    • outputAmount: 1

    • deadline: whatever

  3. The function does not allow a maxInputAmount.

  4. As the transaction is pending in the mempool, the market changes, and the price movement is huge: 1 WETH now costs 10_000 USDC, 10x more than the user expected!

  5. The transaction completes, but the user got charged 10_000 USDC for 1 WETH.

Recommendations

Include a maxInputAmount input parameter in the function declaration, so that the user could specify the maximum amount of tokens he would like to spend and, hence, could predict their spending when using this function of the protocol.

function swapExactOutput(
IERC20 inputToken,
+ uint256 maxInputAmount,
IERC20 outputToken,
uint256 outputAmount,
uint64 deadline
)
public
revertIfZero(outputAmount)
revertIfDeadlinePassed(deadline)
returns (uint256 inputAmount)
{
uint256 inputReserves = inputToken.balanceOf(address(this));
uint256 outputReserves = outputToken.balanceOf(address(this));
​
inputAmount = getInputAmountBasedOnOutput(outputAmount, inputReserves, outputReserves);
​
+ if(inputAmount > maxInputAmount){
+ revert();
+ }
​
_swap(inputToken, inputAmount, outputToken, outputAmount);
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of slippage protection in `TSwapPool::swapExactOutput` causes users to potentially receive way fewer tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.