# Swaps are not split when trade crosses target price

Boot Finance swap curve joins two amplifiers at a target price, but swaps crossing it use only the new A for the whole trade, enabling mispriced execution and arbitrage.

- Payout: Audit contest
- Severity: high
- Program: Boot Finance
- Found by: cmichel
- Disclosed: 2022-01-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-bootfinance-findings/issues/216
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-bootfinance%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** Solidity AMM SwapUtils swap curve (determineA / _calculateSwap / getY)
**Root cause:** SwapUtils.swap/_calculateSwap recomputes the entire trade with the new amplifier aNew when the trade crosses the target price, instead of splitting the trade into an A1 segment up to the target and an A2 segment for the remainder.
**Steps:**
1. Read SwapUtils.determineA to see A1/A2 selection based on target price.
2. In getYC step 5, observe the branch: if aNew != a, it re-runs getY for the full x with aNew.
3. Submit a swap whose size crosses the target price so aNew differs from a.
4. Compare resulting average price against manually splitting into two swaps (A1 up to target, A2 for remainder).
5. Exploit the price discrepancy: swap with one amplifier, then sell result back using the other.
**How found:** Code reading of the swap curve: noticed the curve is a join of two curves at the target price, then traced getYC step 5 and saw the full trade is recomputed with aNew rather than split.
**Exploitation:** Attacker submits a single large swap crossing the target price so the whole trade is priced with the new amplifier, obtaining a better average price than a correctly split trade; then reverses the swap under the other amplifier to capture the difference.
**Insight:** When a pricing curve is piecewise (parameters switch at a threshold), check whether the swap routine segments the trade at the boundary or naively re-evaluates the whole input under the post-crossing parameters — the latter misprices every boundary-crossing trade.