Submitted by Mirror, also found by prapandey031, d3e4, Udsen, ItsNio, pontifex (1, 2), ktg, markus_ether, Testerbot, mert_eren, T1MOH, oakcobalt, and skodi
The pools ratio of y to x must be within the interval [MIN_M, MAX_M), which will be checked by the _checkBalances() function.
External view functions will call the _swap(), _reserveTokenSpecified() or _lpTokenSpecified() functions to get the specified result. However, _checkBalances() is only used in the _swap() and _lpTokenSpecified() functions. There is no balance validation for depositGivenInputAmount() and withdrawGivenOutputAmount() functions, which use the _reserveTokenSpecified() function.
If are no other validations outside of these two functions, user deposits/withdrawls may break the invariant, i.e. the pools ratio of y to x is outside the interval [MIN_M, MAX_M).
Add the following code in the test/EvolvingProteusProperties.t.sol file to the EvolvingProteusProperties contract, and run forge test --mt RatioOutsideExpectedInterval:
Its recommended to add _checkBalances(xi + specifiedAmount, yi) after L579 and add _checkBalances(xi, yi + specifiedAmount) after L582.
Invalid Validation
viraj124 (Shell) commented via duplicate Issue #268:
viraj124 (Shell) confirmed and commented via duplicate Issue #268:
Dravee (judge) increased severity to High
For this audit, 21 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by Udsen received the top score from the judge.
The following wardens also submitted reports: prapandey031, MrPotatoMagic, 0xSmartContract, lsaudit, MohammedRizwan, JP_Courses, 0xprinc, Fulum, plainshift, pontifex, Testerbot, lanrebayode77, Rolezn, Shubham, ast3ros, 0xmystery, nisedo, Mirror, MatricksDeCoder, and chainsnake.
