Submitted by cmichel
The sYETIToken.lastBuyBackPrice is set in buyBack and hardcoded as:
It divides the first and second return amounts of the swap, however, these amounts depend on the swap path parameter that is used by the caller.
If a swap path of length 3 is used, then this is obviously wrong.
It also assumes that each router sorts the pairs the same way (which is true for Uniswap/Sushiswap).
The lastBuyBackPrice will be wrong when using a different path.
This will lead rebases using a different yeti amount and the effectiveYetiTokenBalance being updated wrong.
Verify the first and last element of the path are YETI/YUSD and use the first and last amount parameter.
kingyetifinance (Yeti finance) confirmed and disagreed with severity
alcueca (Judge) commented:
