Submission Details
Impact:
Likelihood:
swap_tokens Allows Swapping Identical Token In and Out
Root + Impact
No validation exists to block swapping from a token to itself.
Description
Calling swap with
from_token == to_tokencauses unnecessary logic execution and potential event/log confusion.
// @> swap_operations.rs
pub fn swap_tokens(...) {
...
// No check to prevent same-token swap
// This opens up gas grief or log spoof
}
Risk
Likelihood:
-
Easy to exploit with simple UI interaction or script
-
Common pattern where validation is forgotten
Impact:
-
Wastes gas, pollutes logs and events
-
May lead to unexpected balances due to rounding
Proof of Concept
No-op swap goes through, produces misleading outcome
swap_tokens(
from_token = DAI,
to_token = DAI,
amount_in = 1_000_000,
min_expected_amount = 1
)
Recommended Mitigation
Add check and then Reject same-token swaps upfront.
ensure!(from_token != to_token, Error::InvalidSwap);
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.