search

GalloDaSballo / Apollon-Review

Notes for the Apollon Solo Security Review
0 stars 0 forks source link

`SwapPair.getSwapFee` charges for crossing the middle price #40

Open GalloDaSballo opened 3 months ago

GalloDaSballo commented 3 months ago

Impact

getSwapFee computes the fee to be paid as follows:

https://github.com/blkswnStudio/ap/blob/8fab2b32b4f55efd92819bd1d0da9bed4b339e87/packages/contracts/contracts/SwapPair.sol#L196-L199

      if ( /// @audit No deviation threshold | Spot vs Oracle
        (postDexPrice > oraclePrice && postDexPrice > preDexPrice) || /// @audit Logical mechanism of swapping?
        (postDexPrice < oraclePrice && preDexPrice > postDexPrice)
      ) {

We can chart out the logic as follows:

Meaning this is charging a fee whenever the absolute postDexPrice surpasses the absolute oracle price

So when crossing the impact is "halved"

When not crossing the middle price, the average between the two dex prices will be very distant from the oracle price, causing the fee to be higher, whereas when crossing the fee would effectively be halved

Mitigation

I don't believe there's any need for a specific mitigation