First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong Internal function used for `TSwapPool::sellPoolTokens`

4rdiii

[H-04] Wrong Internal function used for TSwapPool::sellPoolTokens

Description:
The sellPoolTokens function description states that it should swap a give amount of PoolTokens for weth, as such it should use swapExactInput.But is uses swapExactOutput which can cause for incorrect amount of tokens to swap instead of what user intended.

function swapExactOutput(
IERC20 inputToken,
IERC20 outputToken,
@> uint256 outputAmount,
uint64 deadline
)
function sellPoolTokens(
uint256 poolTokenAmount
) external returns (uint256 wethAmount) {
return
swapExactOutput(
i_poolToken,
i_wethToken,
@> poolTokenAmount,
uint64(block.timestamp)
);
}

Impact:
Since the 3rd input parameter in swapExactOutput is the outputAmount and in the sellPoolTokens sets i_wethToken as outputToken as a result the poolTokenAmount is set as outputAmount which is actually wethAmount not PT amount. this will result in reverts if the max approval is not made by user or if user doesnt have enough funds. but it also can cause higher or lower amount of PT tokens to be traded if the max approval is made and user has enough funds.

Proof of Concept:
in the test below we can see that user intended to sell 1e18 PTs, but more than intended amount was reducted from his balance.

function testSellPoolTokenIsWrong() public {
vm.startPrank(liquidityProvider);
weth.approve(address(pool), UINT256_MAX);
poolToken.approve(address(pool), UINT256_MAX);
pool.deposit(100e18, 100e18, 100e18, uint64(block.timestamp));
vm.stopPrank();
​
vm.startPrank(user);
poolToken.approve(address(pool), UINT256_MAX);
//here user wants to sell 1e18 PTs
pool.sellPoolTokens(1e18);
​
assert(poolToken.balanceOf(user) < 100e18 - 1e18);
}

Recommended Mitigation:
Use swapExactInput instead of swapExactOutput:

function sellPoolTokens(
uint256 poolTokenAmount,
+ uint256 minOutputAmount
) external returns (uint256 wethAmount) {
return
- swapExactOutput(
- i_poolToken,
- i_wethToken,
- poolTokenAmount,
- uint64(block.timestamp)
- );
+ swapExactInput(
+ i_poolToken,
+ poolTokenAmount,
+ i_wethToken,
+ minOutputAmount,
+ uint64(block.timestamp)
+ );
}
Updates

Appeal created

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`sellPoolTokens` mismatches input and output tokens causing users to receive the incorrect amount of tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.