First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`TswapPool::sellPoolTokens` mismatches input and output tokens causing users to receive the incorrect amount of tokens.

sheep

Description: The sellPoolTokens function is intented to allow users to easily sell pool tokens and receive WETH in exchange. Users indicate how many pool tokens they are willing to sell in the poolTokenAMount parameter. However, the function currently micalculates the swapped amount. This is due to the fact that the swapExactOutput function is called, whereas the swapExactInput function is the one that should be called. Because users specify the exact amount of input tokens, not the output.

**Impact:**Users will swap wrong amount of tokens, which is a severe disruption of protocol functionality.

Proof of Concept:

function testsellPoolTokens() public{
uint256 poolTokenAmount = 9e18;
vm.startPrank(liquidityProvider);
weth.approve(address(pool), 100e18);
poolToken.approve(address(pool), 100e18);
pool.deposit(100e18, 100e18, 100e18, uint64(block.timestamp));
vm.stopPrank();
​
//According to the documentation, user send's the input amount of poolTokens to be sold and in return gets the weth
vm.startPrank(user);
poolToken.approve(address(pool), 100e18);
uint256 wethAmountOne = pool.sellPoolTokens(poolTokenAmount);
vm.stopPrank();
​
//Since we have exact amount of poolTokens to be sold we can use swapExactInput to get the same functionality
vm.startPrank(user);
poolToken.approve(address(pool), 100e18);
uint256 wethAmountTwo = pool.swapExactInput(poolToken, poolTokenAmount, weth, 1e18, uint64(block.timestamp));
vm.stopPrank();
​
//These two values should have been the same
assert(wethAmountOne != wethAmountTwo);
​
​
}

Recommended Mitigation:
Consider changing the implementation to use swapExactInput instead of swapExactOutput. Note that this would also require changing the sellPoolTokens function to accept a new parameter (ie minWethToReceive to be passed to swapExactInput)

function sellPoolTokens(
uint256 poolTokenAmount,
+ uint256 minWethToReceive,
) external returns (uint256 wethAmount) {
- return swapExactOutput(i_poolToken, i_wethToken, poolTokenAmount, uint64(block.timestamp));
+ return swapExactInput(i_poolToken, poolTokenAmount, i_wethToken, minWethToReceive, uint64(block.timestamp));
}
Updates

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`sellPoolTokens` mismatches input and output tokens causing users to receive the incorrect amount of tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.