The _swap
function in the TSwapPool contract gives the user an extra token every 10 swaps as an incentive. This behavior breaks the constant product invariant x * y = k
fundamental to Automated Market Makers (AMMs). By transferring an extra token, the pool's reserves become imbalanced, leading to a deviation from the invariant and causing potential economic issues.
TSwapPool.t.sol
```
function testInvariantBreaks() public {
uint256 initialWETH = 50e18;
uint256 initialPoolToken = 100e18;
// Adding initial liquidity to the pool
vm.startPrank(liquidityProvider);
weth.approve(address(pool), type(uint256).max);
poolToken.approve(address(pool), type(uint256).max);
pool.deposit(initialWETH, initialPoolToken, initialPoolToken, uint64(block.timestamp));
vm.stopPrank();
uint256 outputWeth = 1e16;
int256 startingY = int256(weth.balanceOf(address(pool)));
// Negative because Y is taken away from the pool
int256 expectedDeltaY;
vm.startPrank(user);
poolToken.approve(address(pool), type(uint256).max);
// Swap token 10 times
for (uint256 i = 1; i < 11; ++i) {
pool.swapExactOutput(poolToken, weth, outputWeth, uint64(block.timestamp));
expectedDeltaY = int256(-1) * int256(outputWeth) * int256(i);
}
uint256 endingY = weth.balanceOf(address(pool));
int256 actualDeltaY = int256(endingY) - int256(startingY);
// Pool has less token than it suppose to be because it transfer a free token to user every 10 swap
vm.expectRevert();
assertEq(actualDeltaY, expectedDeltaY);
}
```
This shows that the pool is imbalanced because additional tokens are transferred to the user, breaking the invariant.
The constant product invariant is crucial for maintaining the correct price ratios between tokens in the liquidity pool. By breaking this invariant, the pool may imbalanced, severely impact the protocol's core functionality
Manual review
Foundry invariant testing
Consider removing this incentive method.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.