# Stableswap does disjoint swaps, breaking the underlying invariant

MANTRA stableswap computes invariant D and S from only the ask/offer tokens, ignoring other pool tokens, enabling arbitrage and manipulation in 3+ token pools.

- Payout: Audit contest
- Severity: high
- Program: MANTRA
- Found by: carrotsmuggler
- Disclosed: 2025-03-31
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-11-mantra-dex#h-11
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-11
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Stableswap pool swap invariant (helpers.rs calculate_stableswap_y/d)
**Root cause:** calculate_stableswap_y and calculate_stableswap_d sum only offer_pool and ask_pool instead of all pool token balances, so the invariant D/S is wrong for pools with 3+ tokens.
**Steps:**
1. Create or use a stableswap pool with 3+ tokens (A, B, C).
2. Perform an A-B swap via compute_swap; observe calculate_stableswap_y receives only offer_pool and ask_pool.
3. Note calculate_stableswap_d computes sum_pools = offer_pool + ask_pool, ignoring C.
4. Compare resulting slippage to correct Curve-style invariant summing all xp_[i]; observe lower-than-expected slippage.
5. Exploit the mispriced swap for arbitrage against the true invariant.
**How found:** Compared MANTRA's calculate_stableswap_y/d against Curve's stableswap loop that sums all xp_[i]; noticed only ask/offer pools are summed while n_coins is correctly set to assets.len(), revealing the invariant ignores other tokens.
**Exploitation:** Attacker swaps between two tokens in a 3+ token pool where the ignored third token is imbalanced; the pool prices the swap as if only two tokens exist, yielding less slippage than the true invariant requires, enabling arbitrage and pool manipulation.
**Insight:** When auditing stableswap forks, verify the invariant loop iterates over ALL pool coins (xp_[i]) rather than just the swap pair; a correct n_coins with a two-token sum is a telltale sign of a broken multi-asset invariant.