# Slippage tolerance vulnerability in StableSwap

StableSwap deposit slippage check uses a linear ratio instead of the invariant D, so imbalanced deposits exceeding the user's slippage tolerance are accepted.

- Payout: Audit contest
- Severity: medium
- Program: MANTRA
- Credited: DOWSERS
- Disclosed: 2025-03-31
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-11-mantra-dex#m-17
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StableSwap pool deposit slippage validation (helpers.rs assert_slippage_tolerance)
**Root cause:** assert_slippage_tolerance compares a simple pools_total/pool_token_supply ratio against deposits_total/amount, ignoring the StableSwap invariant D and amplification factor A that govern actual price impact on imbalanced deposits.
**Steps:**
1. Pool [1000,1000], A=100, pool_token_supply=2000.
2. User deposits [100,50] with 1% slippage tolerance, receives amount=150 pool tokens.
3. Check computes pool_ratio=2000/2000=1.0, deposit_ratio=150/150=1.0; 1.0*0.99 > 1.0 is false, so tx accepted.
4. Recompute with invariant: D_initial=2000, D_final≈2105, actual slippage=(2105-2000)/2000=5.25% > 1% tolerance.
5. Transaction should have been rejected but passes.
**How found:** Code review of the StableSwap branch in assert_slippage_tolerance; noticed slippage derived from raw sum ratios rather than the StableSwap invariant D, then constructed an imbalanced-deposit example showing the discrepancy.
**Exploitation:** Deposit a highly imbalanced asset mix into a StableSwap pool; the linear ratio check passes while real price impact (per D) far exceeds the user's tolerance, causing unexpected value loss to the depositor.
**Insight:** When auditing AMM slippage guards, verify the check uses the same pricing math (invariant D, amplification A) as the swap/deposit logic; linear sum ratios diverge from curve pricing precisely on imbalanced inputs, which is where tolerance checks silently pass.