TSwapPool::getInputAmountBasedOnOutput
Causes users to pay more than intendedDescription:
The getInputAmountBasedOnOutput
function uses hardcoded values for fees instead of constant defined variables. This in itself is not a good practice, but to add to the problem, the used values are wrong and instead of 1000
basis points, it uses 10000
.
Impact:
Users that intend to swap for an exact output will have to pay 100 - 100*997/10000 = 90.03%
fees instead of 100 - 100*997/1000 = 0.3%
fees.
Proof of Concept:
If x is the inputReserves and y is the outputReserves, the ∆x is calculated like this:
Another way to write this, inputting β = (∆y / y) and assuming γ = 997/1000:
showing the value should be 1000 instead of 10000.
Recommended Mitigation:
Fix the value and also use constant variables for fees.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.