TSwapPool::_swap
the extra tokens given to users after every swapCount
breaks the protocol invariant of x * y = k
Description: The protocol follows a strict invariant of x * y = k
. Where:
x
: The balance of the pool token
y
: The balance of WETH
k
: The constant product of the two balances
This means, that whenever the balances change in the protocol, the ratio between the two amounts should remain constant, hence the k
. However, this is broken due to the extra incentive in the _swap
function. Meaning that over time the protocol funds will be drained.
The issue is found in the next code.
Impact: A user could drain the protocol by doing a lot of swaps and collecting the extra incentive given out by the protocol.
Proof of Concept:
A user swaps 10 times, and collects the extra incentive of 1_000_000_000_000_000_000
tokens
That user continues to swap untill all the protocol funds are drained
Place the following into TSwapPool.t.sol
.
Recommended Mitigation: Remove the extra incentive mechanism. If you want to keep this in, we should account for the change in the x * y = k protocol invariant. Or, we should set aside tokens in the same way we do with fees.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.