Swap fees are not accounted for if users swap directly from the pools

[code423n4]

Handle

shw

Vulnerability details

Impact

The Pool calculates swap fees whenever there is a swap between the SPARTA and the TOKEN or synths. The Router uses this fee value to decide the amount of dividend transferred from the Reserve to the Pool. However, if a user performs the swap by directly calling the functions of pools, the router would not notice the swap fees, thus causing the liquidity providers to get fewer dividends.

Proof of Concept

Referenced code: Pool.sol#L207 Pool.sol#L225 Pool.sol#L241 Pool.sol#L256 Router.sol#L150 Router.sol#L158 Router.sol#L181 Router.sol#L240 Router.sol#L264

Recommended Mitigation Steps

Only allow the router to call the pool's swap functions to ensure that the swap fees are accounted for dividends.

[SamusElderg]

This was a design decision; We will only generate dividends from swaps via the router.

[ghoul-sol]

per sponsor comment, invalid