# Stablepools return wrong price when they do not converge

MANTRA StableSwap compute_d returns a non-converged Newton's method estimate instead of reverting, yielding wrong prices for imbalanced pools and enabling bad swaps.

- Payout: Audit contest
- Severity: medium
- Program: MANTRA
- Credited: DadeKuma
- Disclosed: 2025-03-31
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-11-mantra-dex#m-18
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-18
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** StableSwap pool price computation (helpers.rs compute_d)
**Root cause:** compute_d breaks out of Newton's iteration loop and returns the last estimate even when convergence (delta <= 1) was never reached, unlike Curve which reverts on divergence.
**Steps:**
1. Read `compute_d` in `/contracts/pool-manager/src/helpers.rs#L751`
2. Observe loop runs 256 iterations; on non-convergence it falls through to `Some(d)`
3. Compare to Curve reference which reverts when D does not converge
4. Construct a highly imbalanced pool so Newton's method diverges
5. Swap against the pool; transaction succeeds using an incorrect D/price
**How found:** Code review of the StableSwap math against the original Curve implementation; noticed the convergence check only breaks the loop rather than reverting, so a divergent result is still returned.
**Exploitation:** Attacker swaps in a highly imbalanced pool where Newton's method fails to converge; the pool returns a wrong D and thus wrong price, allowing a swap at an incorrect rate.
**Insight:** When porting Curve StableSwap math, verify the convergence branch actually reverts (or returns an error) on divergence; a bare `break` silently returns a bad D for imbalanced pools.