Submission Details
Severity:
Bad Pool tokens to deposit calculation in `getPoolTokensToDepositBasedOnWeth(...)`
Summary
Bad Pool tokens to deposit calculation in getPoolTokensToDepositBasedOnWeth(...) in TSwapPool.
Vulnerability Details
Bad math in getPoolTokensToDepositBasedOnWeth(...), this calculation was explained in the comments of deposit(...), but it's not mathematically correct.
Same issue for LiquidityTokens
Impact
Some of the impact are, DoS with a deposit(...) function reverting, bad amount of pool tokens provided for liquidity.
Tools Used
Manual review
Recommendations
function getPoolTokensToDepositBasedOnWeth(
uint256 wethToDeposit
) public view returns (uint256) {
uint256 poolTokenReserves = i_poolToken.balanceOf(address(this));
uint256 wethReserves = i_wethToken.balanceOf(address(this));
- return (wethToDeposit * poolTokenReserves) / wethReserves;
+ return (wethToDeposit * wethReserves) / (wethReserves + poolTokenReserves) - poolTokenReserves;
}
Rewards breakdown
nSLOC
276This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.