dex-services
dex-services copied to clipboard
Price Estimates should be capped at one batch
From @fedgiac in #1451
I wonder if this PR can be used for a new attack on the price estimator. What if a fake token was created with a very good order that can be used to bridge between two real tokens, but which can only be filled with a small amount at every step? Something like this:
Tokens: OWL FT DAI Buy->sell amounts: 10 -> MAX128 MAX128 -> 100 Balances: 0 MAX256 10^(18+6)
The price between DAI and USDC is theoretically great, 10 DAI per OWL, but at most 100 wei of DAI can be sold at every batch at that price. To use this trick to manipulate the price you'd need a very large amount of DAI, but for more illiquid tokens it might be doable.
On the other hand, if my trade resolves in 2 batches, I would find that acceptable :stuck_out_tongue: