Summary

The _swapUnderlyingToAsset function includes a minOut check to ensure that the expected output of ALETH is greater than the input amount of WETH. However, the current implementation does not enforce the 1% premium specified in the comment. As a result, the function only validates that the minOut is greater than the input amount.

Vulnerability Details

The current implementation includes the following check:

This ensures _minOut is greater than _amount, but it does not limit _minOut to the desired upper bound, i.e., ((_amount \* 101) / 100). For example:

• If _amount = 1, the valid range for _minOut should be (1, 1.01).

• However, the function allows _minOut values higher than 1.01, which might indicate a logic or configuration issue.

This discrepancy can lead to trades being executed without guaranteeing the desired exchange rate, possibly resulting in financial loss or inefficiency.

Impact

• Financial Loss: The protocol may accept swaps at a higher premium than intended.

• Misalignment with Business Logic: The intended 1% premium is not enforced, resulting in behavior that deviates from expected standards.

Tools Used

Manual Code Review

Recommendations

• Enforce Premium Validation: Update the function to enforce that minOut meets the calculated premium: