# [stable-asset] Computational complexity of `get_y` is not accounted for in multiple extrinsics ## Issue In the stable-asset pallet, the implementation of [`get_y`](https://github.com/nutsfinance/stable-asset/blob/de8b87aa0e9dc458b0398a8c51a8dabad7650d48/lib/stable-asset/src/lib.rs#L805-L856) iterates through all the given input balances (which when used, is bounded by the maximum amount of assets in a pool and is configured as 5:`PoolAssetLimit = ConstU32<5>;`) and also performs an iteration in terms of `y` with the upper bound of `NUMBER_OF_ITERATIONS_TO_CONVERGE` that is configured to be 255. This makes an upper estimate for iterations in `get_y` to O(n+m) = 255 + 5 = 260. The `get_y` method is then called in `get_swap_amount` that is then called in `get_best_route` within a for loop that iterates through all the pools, which makes the estimated computational complexity of the call **O(`number_of_pools` * (`max_number_of_pool_assets` + `NUMBER_OF_ITERATIONS_TO_CONVERGE`))** (please note that `get_best_route` also iterates through the pool assets for every pool before calling `get_swap_amount`). The following extrinsics in the aggregated-dex module use `get_best_route` and are thus affected: `swap_with_exact_supply` and `update_aggregated_swap_paths`. Furthermore, the following extrinsics are affected in stable-asset use `get_y` where the iterations through max `NUMBER_OF_ITERATIONS_TO_CONVERGE` is not accounted for: `swap`, `redeem_single`. ## Further considerations for `get_d` The same underlying issue is present for the `get_d` method as for `get_y`, namely that it performs iterations up to `NUMBER_OF_ITERATIONS_TO_CONVERGE` times. The following extrinsics are affected: `redeem_multi` and `mint` as they use methods that call `get_d`. ## Risk The affected extrinsics might become underweighted in case they are called with the right parameters and/or under certain conditions. Underweighted extrinsics allow attackers to cause block timeouts by calling these insuffienctly weighted extrinsics that would take longer to execute than what their assigned weight indicates. In the case of parachains, having blocks that execute longer than required and as a result exceeding a block production time could stall the block inclusion to the relay chain. ## Mitigation Modify the weight functions accordingly to better estimate the worst-case computational complexity of the affected extrinsics.