0x73696d616f - `FlashSwapRouter` assumes the `Psm`'s `Ra:Ds+Ct` ratio is 1:1 which might not be the case and will lead to loss of funds for users of the router
Audit: 2024-08-cork-protocol-judging
Severity: HIGH

0x73696d616f

High

# `FlashSwapRouter` assumes the `Psm`'s `Ra:Ds+Ct` ratio is 1:1 which might not be the case and will lead to loss of funds for users of the router

### Summary

[FlashSwapRouter::swapDsforRa()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/core/flash-swaps/FlashSwapRouter.sol#L249) calls [DsFlashSwap::getAmountOutSellDS()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/DsFlashSwap.sol#L157), which [gets](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/DsFlashSwap.sol#L170) the `amountOut` based on `amount - repaymentAmount`. This assumes that `amount` and `repaymentAmount`, where the former is `Ds` and the latter `Ra`, are `1:1`, which may not be the case if the `Psm` contract implements an [exchange rate](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/libraries/PsmLib.sol#L186) different than 1.

The same mistake is performed in [FlashSwapRouter::__afterFlashswapBuy()](https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/core/flash-swaps/FlashSwapRouter.sol#L357), the `dsAttributed` amount to the user is treated as 1:1 with `Ra`, which might not be the case.

In both situations, it will lead to the `FlashSwapRouter` reverting or the user losing funds to the amm, depending on the exchange rate.

### Root Cause

In `DsFlashSwap.sol:170`, `amount` and `repaymentAmount` and in `FlashSwapRouter.sol:368,375,377`, the `Ra`, `Ds` and `Ct` amounts are assumed to be 1:1.

### Internal pre-conditions

1. The exchange rate in the `Psm` must be different than `1`.

### External pre-conditions

None.

### Attack Path

1. Users buy or sell `Ra` or `Ds` via the `FlashSwapRouter`.

### Impact

The `FlashSwapRouter` is useless or leads ot loss of funds for the users.

### PoC

`DsFlashSwap.sol`
```solidity
function getAmountOutSellDS(AssetPair storage assetPair, uint256 amount)
    internal
    view
    returns (uint256 amountOut, uint256 repaymentAmount)
{
    ...
    amountOut = amount - repaymentAmount;
    ...
}

```
`FlashSwapRouter.sol`
```solidity
function __afterFlashswapBuy(
    ReserveState storage self,
    Id reserveId,
    uint256 dsId,
    address caller,
    uint256 dsAttributed
) internal {
    AssetPair storage assetPair = self.ds[dsId];
    assetPair.ra.approve(owner(), dsAttributed);

    IPSMcore psm = IPSMcore(owner());
    psm.depositPsm(reserveId, dsAttributed);

    // should be the same, we don't compare with the RA amount since we maybe dealing
    // with a non-rebasing token, in which case the amount deposited and the amount received will always be different
    // so we simply enforce that the amount received is equal to the amount attributed to the user

    // send caller their DS
    assetPair.ds.transfer(caller, dsAttributed);
    // repay flash loan
    assetPair.ct.transfer(msg.sender, dsAttributed)