Merge pull request #238 from Phoenix-Protocol-Group/220-v-phx-vul-020…

…-incorrect-computation-of-return-amount Pool: adds a missed part of return_amount argument
Phoenix-Protocol-Group · Feb 9, 2024 · 9978b81 · 9978b81
2 parents dd5627d + 15cdbbc
commit 9978b81
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,8 +10,10 @@ and this project adheres to
 
 - Update soroban-sdk version from v20.0.3 to v20.1.0 ([#193])
 - Fixes documentation and naming ([#200])
+- Pool: adds a missed part of return_amount argument ([#238])
 
 [#200]: https://github.com/Phoenix-Protocol-Group/phoenix-contracts/pull/200
+[#238]: https://github.com/Phoenix-Protocol-Group/phoenix-contracts/pull/238
 
 ## Added
 

diff --git a/contracts/pool/src/contract.rs b/contracts/pool/src/contract.rs
@@ -672,12 +672,16 @@ fn do_swap(
         referral_fee_bps,
     );
 
+    let total_return_amount = compute_swap.return_amount
+        + compute_swap.commission_amount
+        + compute_swap.referral_fee_amount;
+
     assert_max_spread(
         &env,
         belief_price,
         max_spread,
         offer_amount,
-        compute_swap.return_amount + compute_swap.commission_amount,
+        total_return_amount,
         compute_swap.spread_amount,
     );