The Pool calculates swap fees whenever there is a swap between the SPARTA and the TOKEN or synths. The Router uses this fee value to decide the amount of dividend transferred from the Reserve to the Pool. However, if a user performs the swap by directly calling the functions of pools, the router would not notice the swap fees, thus causing the liquidity providers to get fewer dividends.
Handle
shw
Vulnerability details
Impact
The
Pool
calculates swap fees whenever there is a swap between the SPARTA and the TOKEN or synths. TheRouter
uses this fee value to decide the amount of dividend transferred from theReserve
to thePool
. However, if a user performs the swap by directly calling the functions of pools, the router would not notice the swap fees, thus causing the liquidity providers to get fewer dividends.Proof of Concept
Referenced code: Pool.sol#L207 Pool.sol#L225 Pool.sol#L241 Pool.sol#L256 Router.sol#L150 Router.sol#L158 Router.sol#L181 Router.sol#L240 Router.sol#L264
Recommended Mitigation Steps
Only allow the router to call the pool's swap functions to ensure that the swap fees are accounted for dividends.