roundedSpecifiedAmount can overflow in _swap() and lead to incorrect xf and yf values

Lines of code Vulnerability details Impact This can allow attackers to manipulate the price of the pool by depositing large amounts that trigger the overflow. Proof of Concept The swap function first calculates roundedSpecifiedAmount by calling applyFeeByRounding. In applyFeeByRounding, the...

swapGivenInputAmount() will always revert

Lines of code Vulnerability details Impact swapGivenInputAmount... will always revert leading to a Denial of service. Proof of Concept A call to swapGivenInputAmount... will always revert owing to the logic implementation in the function. function swapGivenInputAmount uint256 xBalance, uint256...

ETH CAN GET LOCKED IN THE CONTRACT DURING THE EXECUTION OF _swap() FUNCTION

Lines of code Vulnerability details Impact In the JBXBuybackDelegate delegate contract, if the swap option is selected after comparing the quote, the JBXBuybackDelegate.swap function will swap the data.amount.value amount of ETH in the following pool.swap call. try pool.swap recipient: addressthi...

Calculation error

Lines of code Vulnerability details Impact function swap uint256 payamt, uint256 buyamtmin, maxAmount is a payamt denominated in token route0 =paygem buyamtmin is a buyamt denominated in token routelast =buygem buyamtmin expectedMarketFeeBPS / 1000 is the fee denominated in token routelast --...

DSA-3286-1 xen - security update

Bulletin has no description...