Part 2

Summary

In initiateSwap function, the function processes swap requests but fails to update the userRequestCount for the caller.

Vulnerability Details
src/market-making/branches/StabilityBranch.sol

initiateSwap function in the StabilityBranch contract fails to increment the userRequestCount for the caller. We expects the request count to increment by 1 after each successful call to initiateSwap.

Imagine this sequence

1. A user calls the initiateSwap function with valid parameters (vaultIds = [1], amountsIn = [100], minAmountsOut = [90]).

2. The function executes but does not update the userRequestCount for the caller.

• Pre-Call State:

  • userRequestCount[msg.sender] = 0

  • vaultIds = [1], amountsIn = [100], minAmountsOut = [90]

• Post-Call State:

  • userRequestCount[msg.sender] = 0 (expected 1)

Root Cause

The initiateSwap function does not include logic to increment the userRequestCount for the caller.

Impact

The system fails to accurately track the number of swap requests created by a user, leading to potential accounting errors.

Tools Used

Vs

Recommendations

Add a state update to increment userRequestCount[msg.sender] in the initiateSwap function