sherlock-audit / 2024-02-leverage-contracts-judging

1 stars 0 forks source link

Afriaudit - Wrong conditional statement in `LightQuoterV3:_simulateSwap` #42

Closed sherlock-admin2 closed 6 months ago

sherlock-admin2 commented 6 months ago

Afriaudit

high

Wrong conditional statement in LightQuoterV3:_simulateSwap

Summary

In the while loop within LightQuoterV3:_simulateSwap, the && operator is utilized to evaluate two distinct conditions: state.amountSpecifiedRemaining != 0 and state.sqrtPriceX96 != cache.sqrtPriceX96Limit. This implies that the loop will persist even if only state.amountSpecifiedRemaining = 0 or only when price limit is reached

Vulnerability Detail

The _simulateSwap swap function ensures that the simulation continues only if there is still an amount left to be swapped and also ensures that ensures that the simulation stops if the price reaches the limit set by sqrtPriceX96Limit. These to conditions are independent variables but the while loop using the && statement will only stop when both state.amountSpecifiedRemaining != 0 and state.sqrtPriceX96 = cache.sqrtPriceX96Limit.

Impact

This will cause simulation to continue when there is 0 amount left and price Limit has not being reached and vice versa

Code Snippet

https://github.com/sherlock-audit/2024-02-leverage-contracts/blob/main/wagmi-leverage/contracts/LightQuoterV3.sol#L240

Tool used

Manual Review

Recommendation

`while (

nevillehuang commented 6 months ago

Invalid, once state.amountSpecifiedRemaining != 0 , state.amountSpecifiedRemaining != 0 && state.sqrtPriceX96 != cache.sqrtPriceX96Limit will return false, and so the logic inside the while loop will not execute. In fact, if you change it to ||, it can potentially completely ignore the sqrtPriceX96Limit acting as a a slippage