Root + Impact

Description:

The flashloan() function calculates the protocol fee by calling getCalculatedFee(), which ultimately relies on getPriceInWeth(). This oracle function fetches the current spot price directly from the underlying TSwap AMM pool. Spot prices in AMMs are highly volatile and can be manipulated within a single transaction. An attacker can execute a swap to artificially drop the token's price immediately before calling flashloan(), which drastically reduces the calculated fee they are required to repay. Once the flashloan concludes, the attacker can swap back to restore the price, profiting from the reduced fee at the expense of the protocol's liquidity providers.

Risk

Likelihood: High. Spot prices are trivially manipulable via flash swaps or standard AMM trades, requiring no upfront capital from the attacker.

Impact: Medium. While it does not result in the direct loss of principal, it systematically reduces the fees collected. Over time, this erodes the yield owed to liquidity providers and creates an unfair advantage for sophisticated attackers.

Proof of Concept:

The PoC demonstrates how the fee calculation directly responds to AMM spot price changes. It fetches the baseline fee, simulates a price manipulation (dropping the price by 10x), and asserts that the resulting flashloan fee is also reduced by 10x, proving the vulnerability.

Recommended Mitigation:

Do not use spot prices from AMMs for fee calculation. Use a TWAP, a Chainlink oracle, or a fixed fee.