The do_swap function allows the user to specify a belief_price. This value works as a slippage protection for the user’s swap, protecting the user from performing a bad swap. At the beginning of do_swap we can find:
Code snippet from the do_swap function. The code transforms belief_price to a Decimal.
let belief_price = belief_price.map(Decimal::percent);
From the above code, we know that belief_price is given as a percent value. Hence, the minimum belief_price that a user can use is 1, which will be transformed to a Decimal with numerator of 1e16.
Looking at the assert_max_spread function, we find:
Code snippet from the assert_max_spread function. The code computes the expected_return from the swap operation.
let expected_return = belief_price.map(|price| offer_amount * price);
If belief_price were 1e16 then this will yield: offer_amount * 1e16 / 1e18, which is equal to 1% of offer_amount.
The above is problematic since the tokens in the pool may have a price relation that requires the user to express a ratio below 1%. For example, USDC and ETH have a 1 ETH / 2600 USDC ratio, which is equal to 0.03%.
Impact
Users will not have protection for price fluctuations for token pairs with a price relation smaller than 1%.
affected file: contracts/pool/src/contract.rs _location: doswap
The
do_swap
function allows the user to specify abelief_price
. This value works as a slippage protection for the user’s swap, protecting the user from performing a bad swap. At the beginning ofdo_swap
we can find:From the above code, we know that
belief_price
is given as a percent value. Hence, the minimumbelief_price
that a user can use is1
, which will be transformed to aDecimal
with numerator of1e16
.Looking at the
assert_max_spread
function, we find:If
belief_price
were1e16
then this will yield:offer_amount * 1e16 / 1e18
, which is equal to 1% ofoffer_amount
.The above is problematic since the tokens in the pool may have a price relation that requires the user to express a ratio below 1%. For example,
USDC
andETH
have a1 ETH / 2600 USDC
ratio, which is equal to 0.03%.Impact
Users will not have protection for price fluctuations for token pairs with a price relation smaller than 1%.
Recommendation
Allow a greater range of
belief_price
.