Bug: Liquidity amounts from Pool.getLiquidityQuote can be miscomputed if using a stale reported price

[Alexangelj]

Description

When a Pool has reserves that are overridden, it means the reserves are real values from on-chain. When these are used to instantiate a Pool class, the reportedPrice method returns a value instead of undefined.

When reportedPrice is not undefined, the getLiquidityQuote static method will enter a special case to compute the amounts of tokens to deposit along with the liquidity minted.

This case will use the reportedPrice to compute the amount of the other side of the pool to deposit. Then, it will use the amounts of the deposits to compute the liquidity that is minted. Finally, it compares the liquidity minted from that computation against the smart contract's method of computing the liquidity to mint (the smart contract does not use this reportedPrice methodology).

There can exist a large discrepancy, which causes the extra liquidity (from the reportedPrice methodology) to be effectively gifted to the other users in the pool.

[github-actions]

🎉 This issue has been resolved in version 1.1.0-rc.7 🎉

The release is available on:

• npm package (@rc dist-tag)
• GitHub release

Your semantic-release bot 📦🚀