F-2024-0009·missing-validation

Unnecessary Swapping of WNATIVE to Itself Allowed in swapNative Function

Acknowledgedindex-funddefirebalancing
TL;DR

swapNative does not reject WNATIVE to WNATIVE, allowing self-swaps that produce no output and only consume gas, opening room for confusion or unintended interactions.

Severity
LOW
Impact
LOW
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The swapNative function allows the swapping of the native token (WNATIVE) with itself. This is generally unnecessary and could lead to confusion or unintended behavior.

Allowing the swap of WNATIVE to itself does not provide any practical utility and may lead to unnecessary transaction fees. Additionally, it introduces potential vectors where users might exploit this behavior for arbitrage or other unintended activities.

03Section · Impact

Impact

The function unnecessarily consumes gas on a no-op operation and may confuse integrators or hide bugs that would otherwise surface as failed swaps.

solidity
function testSwapNative_WNATIVE() public {
uint256 amountIn = 0.5 * 1e18;
uint256 maxSlippage = 50; // 0.5% max slippage
// Send ETH to the contract
(bool success,) = address(swapContract).call{value: 1 ether}("");
require(success, "Failed to send ETH to contract");
// Perform the swap
vm.prank(owner);
uint256 amountOut = swapContract.swapNative(WNATIVE, maxSlippage);
}

The test shows that swapping WNATIVE to WNATIVE does not result in any meaningful output, highlighting the redundancy and potential for confusion.

04Section · Recommendation

Recommendation

Add a require statement in the swapNative function to prevent the swapping of WNATIVE to itself. This will ensure that such unnecessary and potentially harmful operations are not performed.

By adding this require statement, the contract will reject any attempts to swap WNATIVE to WNATIVE, ensuring that only meaningful swaps are processed.

F-2024-0009

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx