# AMM swap formula and return errors

Check constant-product math, parenthesization, reserve indexing, and pool cardinality against the invariant.

_Area: DeFi accounting and math bugs. Seen in 21 disclosed reports; latest 2026-06-25. Updated 2026-10-22._

## How it works
An AMM's swap output is only correct if the formula matches the pool it runs on and the reserves it reads. Bugs appear when the arithmetic is mis-parenthesized, when a formula assumes two tokens but the pool holds more, when only part of the reserves feed the invariant, or when a parameter's meaning is misread. The x*y=k invariant silently breaks, and the contract returns a number that no longer reflects the pool state.

## Where it shows up
- Reimplemented `getAmountsIn`/`getAmountsOut`; diff parenthesization against canonical `(reserveOut - amountOut) * 997` [E2](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-04.md)
- Pool creation without a token-count guard, or a guard hidden inside an optional-parameter branch [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-01.md)
- Stableswap invariant loops summing only offer/ask instead of all `xp_[i]` [E4](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-11.md)
- A price limit passed where a derived price target is required [E5](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-13.md)
- Asymmetric single-sided join/exit math mirrored into a staking contract with `gulp()` [E6](https://bugbountylibrary.com/r/dhl%3A20260625-oceanbpoolsidestaking.md)
- Raw pool balances used as price proxies on UniV3, ignoring tick liquidity [E7](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-02.md)
- Approximated one-sided-supply swap amounts leaving dust [E8](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-16.md)
- Targets set to `min(base, quote*I)` while reserves keep full deposits [E1](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-03.md)

## How to review
For each swap path, confirm the formula's cardinality matches the pool's actual token count, that every reserve the invariant needs is included, and that the inverse formula is algebraically exact. Verify parameter semantics against upstream (limit vs target). For join/exit, test symmetry under repeated max-size operations. The invariant: recomputed reserves after any operation must satisfy the pool's stated invariant for all tokens.

## Variants seen
- Mis-parenthesized inverse formula overcharging exact-output swaps [E2](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-04.md)
- Multi-token pool accepted, two-token formula applied [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-01.md)
- Invariant computed over subset of tokens [E4](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-11.md)
- Limit price used as target price [E5](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-13.md)
- Asymmetric join/exit plus stale-reserve gulp [E6](https://bugbountylibrary.com/r/dhl%3A20260625-oceanbpoolsidestaking.md)
- Constant-sum midpoint on a constant-product pool [E7](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-02.md)
- Approximation instead of closed-form one-sided supply [E8](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-16.md)
- Target below reserve from imbalanced bootstrap [E1](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-03.md)

## Impact and severity
Losses ranged from stuck dust [E8](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-16.md) to ~158 MIM [E1](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-03.md) and ~127.86K mOCEAN drained [E6](https://bugbountylibrary.com/r/dhl%3A20260625-oceanbpoolsidestaking.md). Severity rises when the error is repeatable, when reserves can be synced or gulped, and when anyone can create the malformed pool.

## Why fixes fail
Guards placed inside optional branches are skipped when the parameter is omitted [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-01.md); correct `n_coins` with a two-token sum still passes a superficial check [E4](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-11.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-04.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-01.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-11.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-13.md
- E6: https://bugbountylibrary.com/r/dhl%3A20260625-oceanbpoolsidestaking.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-02.md
- E8: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-16.md