Don't allow swapping the same token

[code423n4]

Handle

Ruhum

Vulnerability details

Impact

A user might mistakenly swap the same two tokens resulting in them losing funds due to the fees, etc.

I think we can assume that no user would really want to swap the same token. So that might as well be prohibited by checking the passed token indexes in the respective functions.

Uniswap for example doesn't allow creating a pool with the same two tokens, see here

Proof of Concept

Here are the relevant functions IMO:

https://github.com/code-423n4/2021-11-bootfinance/blob/main/customswap/contracts/Swap.sol#L356

https://github.com/code-423n4/2021-11-bootfinance/blob/main/customswap/contracts/Swap.sol#L461

Tools Used

Manual Analysis

Recommended Mitigation Steps

Add a require statement:
`require(tokenIndexFrom != tokenIndexTo, "swapping the same token is not allowed");

[chickenpie347]

While this is technically correct, the UI would restrict same-token swaps - and the users who do use SC interaction to swap, likely know better. Adding that statement for a fringe case unnecessarily increases gas costs for all users.

[0xean]

Reopening as a low risk, as the check could be added to mitigate some unintentional user behavior, but the cost is high for all users due to additional gas on every swap.