Submitted by shaflow2, also found by ZanyBonzy, OMEN, nnez, and oakcobalt
https://github.com/code-423n4/2024-08-superposition/blob/4528c9d2dbe1550d2660dac903a8246076044905/pkg/seawater/src/lib.rs#L210
https://github.com/code-423n4/2024-08-superposition/blob/4528c9d2dbe1550d2660dac903a8246076044905/pkg/seawater/src/lib.rs#L290
In the swap_2_internal function, if the first pool experiences a liquidity depletion, it could result in amount_in being less than original_amount. However, the contract might still require the user to transfer original_amount of tokens, causing the user to pay more tokens.
When calling swap2 to convert token1 to token2 through fusdc, if the token1-fusdc pool experiences a liquidity depletion, it will lead to the  issues that the calculated amount_in of token1 will be less than the expected input original_amount.
After the swap_2_internal function completes, if the user is required to pay the protocol original_amount of token1, they end up paying original_amount - amount_in more tokens than they actually receive.
Since compatibility with Permit2 is required, it is recommended to refund the excess tokens back to the user.
af-afk (Superposition) confirmed and commented:
0xsomeone (judge) commented:
