Incorrect token-in transfer amount in swap_2_internal_erc20

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-10-superposition/blob/main/pkg/seawater/src/lib.rs#L286-L297

Vulnerability details

Proof of Concept

In the swap_2_internal function, if the first pool experiences a liquidity depletion, it could result in amount_in being less than original_amount. In this case, the contract takes amount_in tokens from the user and returns original_amount - amount_in tokens back to the user. However, the correct calculation should take original_amount tokens from the user first. The pool loses original_amount - amount_in tokens in such cases.

let (
    original_amount,
    amount_in,
    amount_out,
    _interim_usdc_out,
    _final_tick_in,
    _final_tick_out,
) = Self::swap_2_internal(pools, from, to, amount, min_out)?;

#[cfg(feature = "testing-dbg")]
dbg!((
    "swap 2 internal erc20 after internal",
    amount_in.to_string(),
    amount_out.to_string()
));

// transfer tokens
erc20::take(from, amount_in, permit2)?;
erc20::transfer_to_sender(to, amount_out)?;

if original_amount > amount_in {
    erc20::transfer_to_sender(
        to,
        original_amount
            .checked_sub(amount_in)
            .ok_or(Error::TransferToSenderSub)?,
    )?;
}

Recommended Mitigation Steps

-        erc20::take(from, amount_in, permit2)?;
+        erc20::take(from, original_amount, permit2)?;

Assessed type

Math

[c4-judge]

alex-ppg marked the issue as satisfactory