We can use shorter path for NOTE/CANTO pair

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L558-L592

Vulnerability details

Impact

Longer path can also lead to computation error.

Proof of Concept

For NOTE/CANTO pair, it is not stable pair in the documentation (https://docs.canto.io/overview/canto-dex-and-lp-interface).
Current implementation gets LP price in terms of CANTO and then change it to NOTE.
But we can calculate it directly in terms of NOTE.

Recommended Mitigation Steps

Do same calculation as stable case for NOTE/CANTO pair.

[nivasan1]

Notice that the calculation used for Note/Canto Pair, calculate TVL in Canto and multiply by Price of Note, returns the same value as the other method would, albeit with a little less precision (both values are scaled by 1e18, and will most likely lose be within 1/e15 of each other). It is not clear that this affects function / availability in a noticeable way.

[0xean]

downgrading to QA.