SingleNativeTokenExitV2 assumes first exchange holds the outputToken

[code423n4]

Handle

kenzo

Vulnerability details

SingleNativeTokenExitV2 allows the user to exit and execute trades via multiple exchanges.
When finishing the trades and sending a single output token back to the user,
the contract takes that token from the last swap in the first exchange's trades.
There is nothing in the struct that signifies this will be the output token, and this also impairs the exit functionality.

Impact

Let's say a basket only holds token TOKE, and user would like to exit to DAI.
But there's no exchange with good liquidity for TOKE -> DAI.
So the user crafts a trade to exchange TOKE for WOKE in exchange A, and then exchange WOKE for DAI in exchange B, to finally receive back DAI. The contract will not let him do so, as the output token is taken to be the output token of the first exchange - WOKE in our example.

Proof of Concept

In exit, the output token is taken to be the last token exchanged in the first exchange: (Code ref)

address[] calldata path = _exitTokenStruct
            .trades[0]
            .swaps[_exitTokenStruct.trades[0].swaps.length - 1]
            .path;
        IERC20 outputToken = IERC20(path[path.length - 1]); //this could be not the target token

This manifests the issue I detailed above.

Recommended Mitigation Steps

Have the outputToken be a parameter supplied in ExitTokenStructV2.