WOOFi Swap on Solana — disclosed vulnerability reports and payouts

WOOFi Swap on Solana: State changes are overwritten during anchor serialization when two accounts are the same

WOOFi Solana's swap instruction accepts three pool accounts (from, to, quote) that can alias one another in base-to-quote and quote-to-base swaps. Because Anchor deserializes each account into an in-memory copy, lets the handler mutate them, and then serializes them back to the same account data, a later-written duplicate account silently overwrites changes made to the earlier duplicate. This causes the quote pool's reserve to be updated incorrectly - the to_amount deduction (or from_amount addition) is lost, leaving the on-chain reserve out of sync with the actual token vault balance, which can break swap feasibility and prevent the admin from withdrawing excess fees.