First Flight #18: T-Swap

First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

Wrong Fee Calculations in `TSwapPool::getInputAmountBasedOnOutput` Causes users to pay more than intended

[H-02] Wrong Fee Calculations in TSwapPool::getInputAmountBasedOnOutput Causes users to pay more than intended

Description:
The getInputAmountBasedOnOutput function uses hardcoded values for fees instead of constant defined variables. This in itself is not a good practice, but to add to the problem, the used values are wrong and instead of 1000 basis points, it uses 10000.

function getInputAmountBasedOnOutput(
uint256 outputAmount,
uint256 inputReserves,
uint256 outputReserves
)
public
pure
revertIfZero(outputAmount)
revertIfZero(outputReserves)
returns (uint256 inputAmount)
{
return
@> ((inputReserves * outputAmount) * 10000) /
((outputReserves - outputAmount) * 997);
}

Impact:
Users that intend to swap for an exact output will have to pay 100 - 100*997/10000 = 90.03% fees instead of 100 - 100*997/1000 = 0.3% fees.

Proof of Concept:
If x is the inputReserves and y is the outputReserves, the ∆x is calculated like this:

y = Token Balance Y
x = Token Balance X
x * y = k
x * y = (x + ∆x) * (y − ∆y)
∆x = Change of token balance X
∆y = Change of token balance Y
β = (∆y / y)
α = (∆x / x)
Final invariant equation without fees:
∆x = (β/(1-β)) * x
∆y = (α/(1+α)) * y
Invariant with fees
ρ = fee (between 0 & 1, aka a percentage)
γ = (1 - p) (pronounced gamma)
∆x = (β/(1-β)) * (1/γ) * x
∆y = (αγ/1+αγ) * y

Another way to write this, inputting β = (∆y / y) and assuming γ = 997/1000:

∆x = (x * ∆y ) * 1000 / (y - ∆y) * 997

showing the value should be 1000 instead of 10000.

Recommended Mitigation:

Fix the value and also use constant variables for fees.

Updates

Appeal created

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect fee calculation in TSwapPool::getInputAmountBasedOnOutput causes protocol to take too many tokens from users, resulting in lost fees

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.