Submitted by 13u9
When performing a swap, a position is searched and if a position with an appropriate price exists, the swap is performed using the token amount of that position. If the positions in the current pool do not cover the swap amount requested by the user, the value of sqrt_price will not be set accurately, which may cause confusion when the next user swaps.
https://github.com/code-423n4/2024-08-superposition/blob/main/pkg/seawater/src/pool.rs#L303-L535
When a swap is performed, the swap function in pools.rs is triggered.
https://github.com/code-423n4/2024-08-superposition/blob/main/pkg/seawater/src/pool.rs#L378-L492
When performing a swap, the while statement above iterates through the position that matches the tick and searches for it. If a matching position exists, the token of that position is processed and the state is updated.
The while statement will continue until the swap amount requested by the user becomes 0 or the price reaches the price_limit requested by the user.
https://github.com/code-423n4/2024-08-superposition/blob/main/pkg/seawater/src/pool.rs#L496
After the while loop is finished, the final sqrt_price value is updated to the state.price value.
If the swap amount within the price_limit range requested by the user is not covered by the positions in the pool, the position price will be set to the price_limit value set by the user, not the position price that was actually swapped last; which will be different from the last swapped price, and the user requesting the next swap may be confused about the swap price.
Scenario:
https://github.com/code-423n4/2024-08-superposition/blob/main/pkg/seawater/src/pool.rs#L312-L331
Test Code POC is the code that sets zero_for_one to true and price_limit to U256::MAX and returns an error return in the above conditional statement when the second swap is performed.
Write Test Code in test/lib.rs file:
Add println! code line and remove debugassert statement on swap function in src/pool.rs:
Run Test:
Result:
When requesting a second swap, you can see that an error return occurs because sqrt_price is set to the price_limit set in the previous swap even though the position existed.
Visual Studio Code
Modify to allow setting the value to the price of the last swapped position even if the position amount is insufficient.
Mitigation Test Result:
Test Code is same above Test Code
Unlike before, it is set to the tick where the last swap occurred.
Loop
af-afk (Superposition) confirmed
0xsomeone (judge) commented:
