# Flash swap call back prior to transferring tokens in indexPool

IndexPool.flashSwap invokes the callee callback before transferring out tokens, so the borrower never receives funds and flash swaps are broken.

- Payout: Audit contest
- Severity: high
- Program: Sushi
- Found by: broccoli
- Disclosed: 2021-11-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-findings/issues/26
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** IndexPool.sol flashSwap function
**Root cause:** The tridentSwapCallback is invoked before _transfer of tokenOut, so the callee runs while the pool still holds the tokens and the borrower has received nothing.
**Steps:**
1. Call flashSwap on IndexPool with a callee contract implementing tridentSwapCallback
2. Observe callback executes before `_transfer(tokenOut, amountOut, recipient, unwrapBento)`
3. Callee cannot use received tokens since transfer has not happened yet
4. Fix: move `_transfer` before the callback invocation
**How found:** Code review of flashSwap ordering in IndexPool.sol; noticed callback precedes the outbound transfer, breaking the flash-swap invariant.
**Insight:** In flash-swap implementations, verify the outbound transfer precedes the callback so the callee actually holds borrowed funds; ordering bugs here silently break the feature and may require redeploying all pools.