First Flight #18: T-Swap

Summary

First deposit can be frontrun, which cause it to revert.

Vulnerability Details

By front running the first deposit and then donating just one weth to the pool, you can prevent the depositor from getting the expected amount of LP tokens.

Impact

High, user will get less LP tokens than expected.

Tools Used

unit test

Recommendations

Any of bellow

1. Only allow certain user to do the initial deposit.

2. Do not use the weth.balanceOf(pool) and token.balanceOf(pool) when calculating reserves, instead store the values in the contract and use it in deposit()