Robbed withdrawal

TL;DR

This paper critiques a key theorem in Lie et al. (2023), demonstrating its invalidity and showing that it leads to a critical vulnerability, called robbed withdrawal, in the Wombat Exchange decentralized platform.

Contribution

It identifies an error in a foundational theorem and reveals a new security flaw in the Wombat Exchange system resulting from this mistake.

Findings

Theorem 2 in Lie et al. (2023) is incorrect.

A new vulnerability called robbed withdrawal is identified.

Wombat Exchange is susceptible to this security flaw.

Abstract

In this article we show that Theorem 2 in Lie et al. (2023) is incorrect. Since Wombat Exchange, a decentralized exchange, is built upon Lie et al. (2023) and Theorem 2 is fundamental to Wombat Finance, we show that an undesirable phenomenon, which we call the robbed withdrawal, can happen as a consequence.