Submitted by cmichel
The TridentRouter.complexPath function allows splitting a trade result into several buckets and trade them in a different pool each.
The distribution is defined by the params.percentagePath[i].balancePercentage values:
However, the base value bento.balanceOf(params.percentagePath[i].tokenIn, address(this)); is recomputed after each iteration instead of caching it before the loop.
This leads to not all tokens being used even though the percentages add up to 100%.
Assume I want to trade 50% DAI to WETH and the other 50% DAI to WBTC.
In the first iteration, balanceShares is computed and then 50% of it is swapped in the first pool.
However, in the second iteration, balanceShares is updated again, and only 50% of the remaining (instead of the total) balance, i.e. 25%, is traded.
The final 25% are lost and can be skimmed by anyone afterwards.
Users can lose their funds using complexPath.
Cache the balanceShares value once before the second for loop starts.
sarangparikh22 (Sushi) disputed:
alcueca (judge) commented:
