Issue #57 — Swap/DEX Hardening: Fee-on-Transfer Tokens, Stale Path Prices & Slippage Tests

[Topmatrixmor2014]

Harden the in-contract swap path against fee-on-transfer tokens, stale path prices, and slippage edge cases, and lock the behavior in with tests.

Requirements and Context

contracts/finchippay-contract/src/lib.rs already contains swap primitives — validate_swap_path, compute_swap_fee, compute_required_amount_in, get_swap_fee_bps, and get_fee_collector_address, plus SwapItem/TokenTotal types and ContractError::{SlippageExceeded, ExcessiveAmountIn, InvalidFeeBps}. The swap surface is a natural DeFi attack target, but the token-fee interaction (fee-on-transfer inputs), path-price staleness, and exact-output slippage are under-tested.

Objectives

1. Enforce that the amount actually received (not requested) drives the swap math, so fee-on-transfer inputs cannot under-collateralise the output side.
2. Add staleness validation for multi-hop paths (e.g., reject paths that pass the same token twice or use a zero-liquidity hop).
3. Add comprehensive slippage tests for min_amount_out and max_amount_in, including exact-output rounding.
4. Verify the protocol fee and FeeCollector accounting under edge-case amounts (dust, large values).

Suggested Execution

1. git checkout -b fix/swap-hardening.
2. Update swap helpers in lib.rs to reconcile received-vs-expected amounts.
3. Add tests/swap_hardening.rs with mock pools and a fee-on-transfer token.
4. Run cargo fmt --check && cargo clippy -- -D warnings && cargo test.

Acceptance Criteria

• Swap math uses received amounts, not requested amounts, for fee-on-transfer inputs.
• Malformed or stale paths are rejected with InvalidPath / a staleness error (≥4 tests).
• min_amount_out / max_amount_in are respected under rounding (≥4 tests).
• Protocol fee accrues correctly to FeeCollector for edge-case amounts.

Guidelines

• Reuse existing compute_swap_fee / compute_required_amount_in; do not rewrite the fee model.
• Add events for swaps (amount in, amount out, fee, path length) to aid off-chain reconciliation.

Timeframe: 96 hours

---

[github-actions]

🤖 Greptile AI Context

Greptile has indexed this repository and can provide AI-assisted code review
and context for this issue.

How to use Greptile on this issue:

• Comment @greptileai to ask about relevant code, files, or implementation approaches
• Reference specific files or error messages for targeted analysis
• Use @greptileai explain <file> to get an explanation of any file

Greptile is configured with project-specific rules in .greptile/config.json.

[KarenZita01]

Hi maintainer, I'd like to work on this issue. I have experience in frontend, backend and contract. And I can deliver aa clean pr on time. Thanks

[sebas11042]

Hi! I'm a software developer with experience contributing to blockchain and Stellar-related open-source projects, including work around escrow/payment flows and transaction safety. I've been focusing on issues where financial correctness and edge-case handling are especially important, and I'd be interested in contributing to this one.

I'd harden the swap flow by reconciling the actual received token amount before performing swap calculations, adding validation for invalid/stale multi-hop paths, and covering min_amount_out / max_amount_in, rounding, and protocol-fee edge cases. I'd also add the requested swap events and focused tests with mock pools and fee-on-transfer behavior, while reusing the existing fee helpers and keeping the current contract API intact.