Missing checks compared with the CurveTwoCryptoOptimized Vyper code
Some invariants are not checked in the Solidity code, but they are checked in the original Vyper code.
For example, the Solidity code does not check the frac
invariant in tweakPrice
. The original Vyper↗ code performs the following check:
for k in range(N_COINS):
frac: uint256 = xp[k] * 10**18 / D # <----- Check validity of
assert (frac > 10**16 - 1) and (frac < 10**20 + 1) # p_new.
Additionally, the Solidity code does not check that the token_amount
is less than the total token_supply
, as the original Vyper↗ does.
Similarly, throughout the contract, other checks are missing. We note, however, that we could not identify any direct security implications of these missing checks.