Inconsistent Swap Execution Due to Ambiguous directional Logic
Summary
The reliance on secondary conditions like walletData.length instead of making directional the sole determinant will cause unintended swap flows for users as the swap() function executes both DeFi and stablecoin swaps when only one swap was expected.
Root Cause
The choice to rely on both directional and walletData.length to control the swap flow is a mistake as this creates ambiguity, resulting in inconsistent and unintended execution paths.
Internal pre-conditions
No response
External pre-conditions
No response
Attack Path
SWAPPER_ROLE calls swap() with directional set to true and walletData.length non-zero.
Both _defiSwap() and _stablecoinSwap() execute even when only one was expected, adjusting ss.oAmount based on incorrect balance differentials.
The user receives an incorrect token amount due to unexpected swap sequencing.
Impact
Users experience incorrect token amounts or unexpected swap flows, causing an approximate loss due to mismatched token balances. The protocol risks users losing confidence in its consistency and reliability.
PoC
Call swap() with directional set to true and walletData.length populated.
Observe the execution of both _defiSwap() and _stablecoinSwap() and the resulting value of ss.oAmount.
Mitigation
Enforcedirectionalas the Sole Controller: Refactor swap() so directional fully dictates swap order, eliminating reliance on walletData.length.
Separate Execution Paths: Distinguish clearly between DeFi-only, stablecoin-only, and combined swaps to avoid unintended dual executions.
AdamSzymanski
Medium
Inconsistent Swap Execution Due to Ambiguous
directionalLogicSummary
The reliance on secondary conditions like
walletData.lengthinstead of makingdirectionalthe sole determinant will cause unintended swap flows for users as theswap()function executes both DeFi and stablecoin swaps when only one swap was expected.Root Cause
The choice to rely on both
directionalandwalletData.lengthto control the swap flow is a mistake as this creates ambiguity, resulting in inconsistent and unintended execution paths.Internal pre-conditions
No response
External pre-conditions
No response
Attack Path
SWAPPER_ROLEcallsswap()withdirectionalset to true andwalletData.lengthnon-zero._defiSwap()and_stablecoinSwap()execute even when only one was expected, adjustingss.oAmountbased on incorrect balance differentials.Impact
Users experience incorrect token amounts or unexpected swap flows, causing an approximate loss due to mismatched token balances. The protocol risks users losing confidence in its consistency and reliability.
PoC
swap()withdirectionalset to true andwalletData.lengthpopulated._defiSwap()and_stablecoinSwap()and the resulting value ofss.oAmount.Mitigation
Enforcedirectionalas the Sole Controller:Refactorswap()sodirectionalfully dictates swap order, eliminating reliance onwalletData.length.Separate Execution Paths:Distinguish clearly between DeFi-only, stablecoin-only, and combined swaps to avoid unintended dual executions.