TSwapPool::swapExactOutput
causes users to potentially receive way fewer tokensDescription: The swapExactOutput
function does not include any sort of slippage protection. A similar case is found in TSwapPool::swapExactInput
, here the function specifies a minOutputAmount
, the swapExactOutput
function should specify a maxInputAmount
.
Impact: If market conditions change before the transaciton processes, the user could get a much worse swap.
Proof of Concept:
The price of 1 WETH right now is 1,000 USDC
User inputs a swapExactOutput
looking for 1 WETH
inputToken = USDC
outputToken = WETH
outputAmount = 1
deadline = whatever
The function does not offer a maxInput amount
As the transaction is pending in the mempool, the market changes! And the price moves HUGE -> 1 WETH is now 10,000 USDC. 10x more than the user expected
The transaction completes, but the user sent the protocol 10,000 USDC instead of the expected 1,000 USDC
Recommended Mitigation: We should include a maxInputAmount
so the user only has to spend up to a specific amount, and can predict how much they will spend on the protocol.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.