Missing checks if pairs equal tokens

[code423n4]

Handle

defsec

Vulnerability details

Impact

The uniSwapLikeRouter.getAmountsOut, the contracts are not checking if the pairs are same.

Also, it does not check that the tokens actually match the pair.

It's easy to set faulty liquidation paths which then end up reverting the liquidation transactions.

Proof of Concept

1. Navigate to the following contracts. Swap is completed through router. In the following contract,

There is check missing if the inputToken and outputToken is same.

"https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/singleJoinExit/SingleTokenJoinV2.sol#L80"

Tools Used

None

Recommended Mitigation Steps

Check inputToken != outputToken.

[0xleastwood]

I believe you would only cause your own tx to revert. So marking as non-critical.