The Router.swapWithSynthsWithLimit allows trading token to token and specifying slippage protection. A token to token trade consists of two trades:
The slippage protection of the second trade (base to token) is computed wrong:
It compares the token input amount (of the first trade) to the base reserve of the second pair.
Slippage protection fails and either the trade is cancelled when it shouldnt be or it is accepted even though the user suffered more losses than expected.
Recommend it should use the base output from the first trade to check for slippage protection. Note that this still just computes the slippage protection of each trade individually. An even better way would be to come up with a formula to compute the slippage on the two trades at once.
strictly-scarce (vader) confirmed:
Mervyn853 commented:
