# Same-asset swap zero-cost collapse

Swap or repay paths where in and out asset can be equal, collapsing reserve math to the floor

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2024-09-06. Updated 2026-10-29._

## How it works
AMM and share math prices a move by the difference between reserves before and after. That difference is only meaningful when the in and out assets are distinct. If the code lets the same asset (or same index) appear on both sides, the "new reserve" equals the old reserve, the difference collapses to zero, and any minimum floor (like a saturating add of 1) becomes the entire price. The assumption that breaks: that in and out are always different assets. Nothing enforces it, so a caller pays a token amount for an arbitrary output.

## Where it shows up
- Swap, buy, sell, or repay entrypoints taking asset_in and asset_out (or indices) with no `asset_in != asset_out` check.
- Reserve-difference formulas where equal indices make new_reserve == old_reserve.
- A minimum-amount floor (e.g. `+1`) that silently becomes the whole cost.

## How to review
The invariant: for any priced move, the in and out assets must be distinct, and the computed input must be strictly greater than the floor for non-trivial output. Check that every swap/repay path rejects equal assets before pricing. Trace the math with equal inputs and confirm it cannot yield the floor value.

## Variants seen
- Same-asset buy: asset_in == asset_out makes amount_in compute to 1, draining pool liquidity [E1](https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AH-01.md).

## Why fixes fail
A floor like `+1` does not fix the root cause; it only sets the price to the floor, which is still negligible [E1](https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AH-01.md). The real fix is rejecting equal assets before pricing.

## Impact and severity
E1 allowed draining the entirety of stable swap pool liquidity for negligible cost: critical. Severity is highest where the collapse yields a near-zero price on a live pool; it worsens when no floor or cap limits output per call.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AH-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AH-09.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-10.md