When Swap's constructor sets the initial swapFee to the value of the argument swapFee, it doesn't check that this value is smaller than SWAP_FEE_DIVISOR.
Impact
If swapFee equals SWAP_FEE_DIVISOR, then the system charges 100% fees so users have no reason to use it. If swapFee is greater than SWAP_FEE_DIVISOR, then the swaps won't work at all. Instead, they will always revert due to an underflow on SWAP_FEE_DIVISOR.sub(swapFee).
Tool Used
Manual code review.
Recommended Mitigation Steps
Require swapFee_ < SWAP_FEE_DIVISOR in Swap's constructor.
Handle
pants
Vulnerability details
When
Swap
's constructor sets the initialswapFee
to the value of the argumentswapFee
, it doesn't check that this value is smaller thanSWAP_FEE_DIVISOR
.Impact
If
swapFee
equalsSWAP_FEE_DIVISOR
, then the system charges 100% fees so users have no reason to use it. IfswapFee
is greater thanSWAP_FEE_DIVISOR
, then the swaps won't work at all. Instead, they will always revert due to an underflow onSWAP_FEE_DIVISOR.sub(swapFee)
.Tool Used
Manual code review.
Recommended Mitigation Steps
Require
swapFee_ < SWAP_FEE_DIVISOR
inSwap
's constructor.