# Swapped argument order in DeFi swaps

Check token/amount argument order and path direction against pool signatures and encodings

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-08-13. Updated 2026-10-23._

## How it works
A function receives two or more positional values that are semantically distinct (tokenIn vs tokenOut, native vs foreign amount, source vs dest). The caller passes them in the wrong order, or reuses a parser/flag built for one ordering on data with the opposite ordering. The compiler cannot tell the difference because the types match, so the contract runs with roles inverted: slippage and loss checks apply to the wrong asset, amounts land in the wrong pool slot, or a boolean flips a conversion. The broken assumption is that positional order and encoding direction are self-evident and consistent across branches.

## Where it shows up
- Shared path parsers used for both exactInput and exactOutput swaps [E1](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.2.md)
- Multi-hop branches that copy-paste a pool call and reorder arguments [E2](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-15.md)
- A token-ordering flag (e.g. ethIs0) derived from one pool but applied to values from another [E3](https://bugbountylibrary.com/r/c4%3A2021-11-overlay%3AH-01.md)
- Long positional return tuples destructured at call sites [E4](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03.md)
- Estimation helpers where the token path direction does not match the input amount's denomination [E5](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-11.md)

## How to review
For every call with two same-typed positional arguments, name each argument at the call site and match it to the callee's parameter name and meaning. For path parsing, confirm the extraction direction matches the encoding: exactOutput paths are reversed relative to exactInput [E1](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.2.md). For flags, trace the flag's origin and confirm every value it normalizes comes from the same source [E3](https://bugbountylibrary.com/r/c4%3A2021-11-overlay%3AH-01.md). For tuples, diff the return list against each destructuring site and count placeholders [E4](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03.md). The invariant: the semantic role of each value at the call site equals the role the callee assumes.

## Variants seen
- Reversed path encoding parsed with forward-order logic [E1](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.2.md)
- Native/foreign amount swapped in a 3-path hop branch [E2](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-15.md)
- Ordering flag from one pool applied to another pool's liquidity [E3](https://bugbountylibrary.com/r/c4%3A2021-11-overlay%3AH-01.md)
- Missing comma in tuple destructuring shifting slots [E4](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03.md)
- Wrong-direction path fed a differently denominated amount [E5](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-11.md)

## Impact and severity
Consequences ranged from all multi-hop swaps reverting [E2](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-15.md) to bypassed slippage and loss checks [E1](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.2.md), inverted market depth [E3](https://bugbountylibrary.com/r/c4%3A2021-11-overlay%3AH-01.md), corrupted early-exit logic [E4](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03.md), and wrong slippage estimates enabling sandwiching [E5](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-11.md). Severity rises when the swap feeds accounting or safety checks, since the wrong asset is validated while the real one is not.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.2.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-15.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-11-overlay%3AH-01.md
- E4: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03.md
- E5: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-11.md