Trick or Treat

Summary

The setTreatCost() function does the work of manipulating the cost of treats already defined in the addTreat() function.

Vulnerability Details

The setTreatCost() defined in line 43 of the SpookySwap takes a treat struct and the new cost as an argument. This changes the cost of the treat already defined in addTreat() function to new cost passed as an argument to the function.

Impact

This ability to manipulate cost of treats put the user as the risk of paying more than anticipated for a swap without falling for a trick.

Tools Used

Manual Review

Recommendations

The check used in the setTreatCost() function to ensure that treat prices cost more than zero should be used in addTreat() and the setTreatCost() should be deleted as it is of no importance to the logic of the protocol.