Skip to content
Request an audit

‹ All findings

PHyperLPoolSwapInside::_swapWithCustomData() checks price manipulation for pool, but the router used may route through another pool

Low/InfoClip Finance Strategy Upgrade·by the Three Sigma team·DeFi infrastructure·15th March 20243S-Clip-L05

Report PageSource

Description

PHyperLPoolSwapInside::_swapWithCustomData() checks price manipulation for pool; however, the router chosen may route through a different pool, rendering the price manipulation useless and leading to MEV.

Recommendation

Either enforce that the router used routes through the pool or do the price manipulation check for the pool that the router routed through.

Status

Acknowledged

Found during Three Sigma’s team review · 0xSimao on the review team