AdamSzymanski - Inconsistent Swap Execution Due to Ambiguous directional Logic

[sherlock-admin2]

AdamSzymanski

Medium

Inconsistent Swap Execution Due to Ambiguous directional Logic

Summary

The reliance on secondary conditions like walletData.length instead of making directional the sole determinant will cause unintended swap flows for users as the swap() function executes both DeFi and stablecoin swaps when only one swap was expected.

Root Cause

The choice to rely on both directional and walletData.length to control the swap flow is a mistake as this creates ambiguity, resulting in inconsistent and unintended execution paths.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

1. SWAPPER_ROLE calls swap() with directional set to true and walletData.length non-zero.
2. Both _defiSwap() and _stablecoinSwap() execute even when only one was expected, adjusting ss.oAmount based on incorrect balance differentials.
3. The user receives an incorrect token amount due to unexpected swap sequencing.

Impact

Users experience incorrect token amounts or unexpected swap flows, causing an approximate loss due to mismatched token balances. The protocol risks users losing confidence in its consistency and reliability.

PoC

1. Call swap() with directional set to true and walletData.length populated.
2. Observe the execution of both _defiSwap() and _stablecoinSwap() and the resulting value of ss.oAmount.

Mitigation

1. Enforce directional as the Sole Controller: Refactor swap() so directional fully dictates swap order, eliminating reliance on walletData.length.
2. Separate Execution Paths: Distinguish clearly between DeFi-only, stablecoin-only, and combined swaps to avoid unintended dual executions.