The constant product invariant can be broken.

Lines of code Vulnerability details description Let reserves returned by Well.getReserves as x, y and Well.tokenSupply as k. They must maintain the invariant x y EXPPRECISION = k 2. However, the reserves can increase without updating the token supply if a user transfers one token of the well and...

Long term denial of service due to lack of fees in Well

Lines of code Vulnerability details Description The Well allows users to permissionless swap assets or add and remove liquidity. Users specify the intended slippage in swapFrom, in minAmountOut. The ConstantProduct2 implementation ensures Kend - Kstart = 0, where K = Reserve1 Reserve2, and the...

Malicious lender can create pool imbalance by tricking V2 pool into accepting disproportionately large number of long tokens in exchange for short tokens

Lines of code Vulnerability details Impact Timeswap V2 Pool works on constant product AMM where the total long tokens & short tokens follow the equation total long total short = L. Any increase in short tokens caused by lenders has to be accompanied with a proportionate drop in long tokens to kee...

Malicious borrower can create pool imbalance by tricking the V2 pool to send lesser number of long tokens in exchange for short tokens

Lines of code Vulnerability details Impact Timeswap V2 Pool works on constant product AMM where total long tokens & short tokens follow the equation total long total short = L. Any increase in long tokens has to be accompanied with a proportionate drop in short tokens and viceversa to ensure that...

A malicious rebalancer can imbalance the constant sum nature of long token pool by depositing a larger number of input tokens for a smaller number of output tokens. This also imbalances the constant product nature of 3 token pool

Lines of code Vulnerability details Impact Token0 and Token1 follow the properties of a constant sum pool. deltax token0 change is balanced proportionately by deltay token1 change adjusted for strike. Arbitrageurs can use the constant sum property to rebalance the pool based on the level of strik...

JoeLibrary.sol#L19 : quote does not follow the constant sum formula to get the reserve value

Lines of code Vulnerability details Impact The quoted reserve value is not based on the constant sum approach. It is based on constant product method. The quoted values are not correct for constant sum based approach. Proof of Concept As per the Joe documentation, it says that joe is based on...