E1 MitigationConfirmed

[c4-bot-9]

Lines of code

Vulnerability details

Lines of code

Vulnerability details

Summary of E1

The PR adds the function depositZapSwapWithdraw() which zap-swaps without involving the arb flow.

Function depositZapSwapWithdraw() is only callable from inside _dualZapInLiquidity() at L56 and L68 which is in turn callable from Liquidity::depositLiquidityAndIncreaseShare().

Aspects Audited

• Correct access control : can be called only by address(liquidity).
• Correct calculations : no arb is done.

No additional negative impact seen.

Informational note

There is no check above L50 which ensures that reserves are above DUST amount (such checks are present throughout the protocol before other calls to _adjustReservesForSwap). However, this is not necessary due to the combination of checks in Pools.sol#L445-448 and in L48 & L60. This is just an informational note in case the protocol wants to add an explicit check too.

Conclusion

LGTM

[c4-judge]

Picodes marked the issue as satisfactory