First Flight #18: T-Swap

Summary

Donating weth to the pool will cause liquidity providers getting less than expected LP tokens.

Vulnerability Details

The attack is on this formula which calculate how much LP to mint to the liquidity provider, it is as simple as donating weth, the more the attacker the less LP tokens will be minted to the liquidity providers.

Impact

High, liquidity providers are getting less LP tokens that what should be.

Tools Used

Unit test.

Recommendations

Store the weth reserves in the contract and use it to calculate liquidityTokensToMint, the weth reserve value can be updated after deposit.