Protocol is wrongly refunding too many funds in a swap

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-10-superposition/blob/7ad51104a8514d46e5c3d756264564426f2927fe/pkg/seawater/src/lib.rs#L290-L297

Vulnerability details

Impact

AMM is providing excessive refunds for each swap, which may result in the funds being drained.

Proof of Concept

This previous issue wasn't fixed properly:
code-423n4/2024-08-superposition-findings#12

With the current new logic, users are refunded with an excessive amount of tokens:

        erc20::take(from, amount_in, permit2)?;
        erc20::transfer_to_sender(to, amount_out)?;

        if original_amount > amount_in {
            erc20::transfer_to_sender(
                to,
                original_amount
                    .checked_sub(amount_in)
                    .ok_or(Error::TransferToSenderSub)?,
            )?;
        }

https://github.com/code-423n4/2024-10-superposition/blob/7ad51104a8514d46e5c3d756264564426f2927fe/pkg/seawater/src/lib.rs#L290-L297

The issue was that an user was paying original_amount even if the actual swap was only amount_in, but now:

1. User pays amount_in (the actual swap amount)
2. User receives amount_out (the actual swap amount)
3. If the original intended payment is higher than the actual swap amount, users are 'refunded' with the difference between these values

This can be abused to drain all the funds from the AMM.

Recommended mitigation steps

Consider removing the last transfer:

        erc20::take(from, amount_in, permit2)?;
        erc20::transfer_to_sender(to, amount_out)?;

-       if original_amount > amount_in {
-           erc20::transfer_to_sender(
-               to,
-               original_amount
-                   .checked_sub(amount_in)
-                   .ok_or(Error::TransferToSenderSub)?,
-           )?;
-       }

[c4-judge]

alex-ppg marked the issue as satisfactory