Description:
Assumptions behind this mechanism is to protect users from overpaying for token swaps. The minSweepOut parameter is a minimum required amount that users expect to get back from the initial amountIn, in order for the swap to succeed.
For example:
the user provides 1ETH and wants to swap for only 500 USDC,
they want min 0.49 ETH back (1ETH = 1000$), however the leftover is 0.47ETH,
the swap should revert.
There are two issues with this mechanism:
Typo in condition: Current mechanism would accept unwanted cases where leftovers are lower than minSweepOut.
Improper use of the mechanism: The minSweepOut it set to 0 in LibActionBundler.sol#L65 which means that
the protection mechanism is not used.
Recommendation:
Fix the condition in UniswapV2Swapper to the following: it should be:
if (minSweepOut > 0 && minSweepOut > leftover)
Consider percentage as a unit to handle tokens with different numbers of zeros in a uniform way.
In the LibActionBundler contract allow the minSweepOut parameter to be passed, rather than hard-code an option that disables the security mechanism.
Where: https://github.com/Fujicracy/fuji-v2/blob/bffa427797ad8d6df63671868ee8823574e044ca/packages/protocol/src/swappers/UniswapV2Swapper.sol#L81-L83
Description: Assumptions behind this mechanism is to protect users from overpaying for token swaps. The
minSweepOutparameter is a minimum required amount that users expect to get back from the initialamountIn, in order for the swap to succeed.For example:
There are two issues with this mechanism:
minSweepOut.minSweepOutit set to 0 in LibActionBundler.sol#L65 which means that the protection mechanism is not used.Recommendation:
minSweepOutparameter to be passed, rather than hard-code an option that disables the security mechanism.