# Swaps can happen without changing the price for the next trade due to gamma = 0

WooPPV2 gamma rounds to zero on small swaps, so repeated dust trades leave oracle price unchanged, letting a trader avoid slippage.

- Payout: Contest reward
- Severity: medium
- Program: Woofi Swap
- Credited: mstpr-brainbot
- Disclosed: 2024-03-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-woofi-swap-judging/issues/42
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-woofi-swap%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:precision-loss

**Target:** WooPPV2 AMM pool swap price calculation (_calcQuoteAmountSellBase)
**Root cause:** gamma = baseAmount*price*coeff/priceDec/baseDec rounds down to 0 for small baseAmount, so newPrice = (1e18-gamma)*price/1e18 equals old price while quoteAmount is still nonzero.
**Steps:**
1. Set coeff=1e-17*1e18, spread=0.001*1e18, price=0.01*1e8, baseAmount=1e18 (1 WOO).
2. Compute gamma = baseAmount*price*coeff/priceDec/baseDec -> 0 due to rounding.
3. Call `router.swap(WOO, USDC, 1e18, 0, ...)` in a loop 1000 times in one tx.
4. Observe cumulative ~9.98 DAI received while `oracle.woPrice(WOO)` is unchanged.
**How found:** Code review of _calcQuoteAmountSellBase noticed gamma is integer-divided and can round to zero, then hand-computed a small-amount example and wrote a Foundry PoC looping swaps.
**Exploitation:** Trader splits a large trade into many small swaps each below the gamma rounding threshold, executing them in a loop on a cheap network so the oracle price never moves; repeated iterations extract more value without slippage.
**Escalation:** More loop iterations on cheap gas networks increase total traded volume while price stays fixed.
**Insight:** In AMM price-impact formulas, check whether the impact term (gamma/coeff*amount) can integer-round to zero for amounts that still yield nonzero output; looped dust swaps can then bypass slippage entirely.