First Flight #18: T-Swap

Summary

The getInputAmountBasedOnOutput function in the TSwap contract incorrectly calculates the input amount required for a given output amount due to an error in the fee calculation. The function scales the amount by 10000 instead of 1000, causing the protocol to take more tokens from users than intended. This results in users paying higher fees than expected.

Vulnerability Details

The getInputAmountBasedOnOutput function is designed to calculate the amount of input tokens required to obtain a specified amount of output tokens. However, the function currently miscalculates the fee, scaling the amount by 10000 instead of the correct scale of 1000. This error leads to the protocol deducting more tokens from users than necessary, resulting in excessive fees being charged. The incorrect calculation is as follows:

The correct calculation should scale by 1,000 to accurately compute the fee:

As a result, users swapping tokens via the swapExactOutput function will pay significantly more tokens than expected for their trades. This issue is exacerbated when users provide infinite allowance to the TSwapPool contract, as it exposes them to continuous overcharging.

Impact

1. Financial Loss to Users: Users are charged higher fees than expected, leading to financial losses.

2. User Trust: Users can lose trust in the TSwapprotocol due to unexpected and excessive fees.

3. Potential Exploitation: Malicious actors could exploit this flaw to trick users into unfavorable trades, ultimately draining liquidity from the pool.

Tools Used

1. Manual Code Review

Recommendations

To fix this vulnerability, the fee calculation in the getInputAmountBasedOnOutput function should be corrected to scale by 1000 instead of 10000. The corrected code is as follows:

This change ensures that the fee calculation is accurate, preventing the protocol from overcharging users.