Submission Details
Severity:
Fee miscalculation in TSwapPool::getInputAmountBasedOnOutput
Summary
Wrong value of numerator in TSwapPool::getInputAmountBasedOnOutput
Vulnerability Details
The function TSwapPool::getInputAmountBasedOnOutput uses the value of 10000 in it's numerator but it must use 1000 instead.
By doing that it will use the 0.3 % fee which is represented in this case by doing 997 / 1000 in the function calculations
Impact
The method miscalculates fee which makes all methods that rely on it not giving the expected output.
Tools Used
Manual Review
Recommendations
- ((inputReserves * outputAmount) * 10000) /
+ ((inputReserves * outputAmount) * 1000) /
Updates
Appeal created
inallhonesty 11 months ago
Submission Judgement Published Assigned finding tags:
Incorrect fee calculation in TSwapPool::getInputAmountBasedOnOutput causes protocol to take too many tokens from users, resulting in lost fees
Rewards breakdown
nSLOC
276This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.