# _handleSwapAction(...) creates situations where the arguments receiver and sweeper need to be the same address in BaseRouter Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-N13 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description In _handleSwapAction(...) the function checks if both the receiver and sweeper are the beneficiary given certain conditions. Since there can only be one beneficiary there are situations where a user can't name the receiver and sweeper as two different addresses. ### Recommendation This should be explained as expected behavior in the documentation or in comments. ### Status Addressed here: [Fujicracy/fuji-v2#626](https://github.com/Fujicracy/fuji-v2/pull/626) --- Related findings: - [Anyone can frontrun a relayer interaction with the same arguments but a much higher/lower relayer fee](https://0xsimao.com/findings/singularity-frontrun-relayer-interaction-fee): Singularity - [FlashSwapRouter::emptyReserve() and FlashSwapROuter::emptyReservePartial() functions return incorrect values](https://0xsimao.com/findings/cork-protocol-flash-empty-outer-partial): Cork Protocol - [Attackers will steal the reserve from the `Vault` by receiving `ra` in `FlashSwapRouter::__swapDsforRa()`](https://0xsimao.com/findings/cork-protocol-steal-receiving-flash-dsfor): Cork Protocol - [mTapiocaOFT can't be rebalanced because the Balancer in tapiocaz-audit calls swapETH() or swap() of the RouterETH but does not forward ether for the message fee](https://0xsimao.com/findings/tapioca-dao-rebalanced-balancer-eth-fee): Tapioca DAO