Lack of route path validation in `claimAndSwap` function
Summary
The claimAndSwap function doesn't validate the passed routes.
Vulnerability Details
The claimAndSwap function accepts route parameter with arbitrary consequences of routes, consisting of (tokenIn, tokenOut) parameters. However, when the swap uses more than one pool, it is not checked that the tokenOut parameter of the first pool matches the tokenIn parameter of the second pool.
For example, if the swap is WETH -> USDT in pool1, then USDT -> ALETH pool2, it is not checked if the tokenOut of the pool1 is equal to the tokenIn of the pool2.
Impact
An invalid route can be passed and pools without a matching token pair will be used resulting in unintended outcomes or token mismatches.
Tools Used
Manuel Review
Recommendations
Validate the tokenOut to match the tokenIn.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.