Beedle - Oracle free perpetual lending

Summary

Fee.sol's sellProfits swaps tokens in a pool on uniswap. Fee is set to 3000, but there may not be a pool with a fee of 3000. In this case, a malicious user can intentionally create a pool with a high price of WETH and steal part of the fee.

Vulnerability Details

The sellProfits in Fees.sol has a fixed fee of 3000. In Uniswap V3, there are four fee tiers: 1%, 0.3%, 0.05%, and 0.01%, and 3000 means a 0.3% pool. In this case, the 0.3% pool may not exist, and a malicious user who knows this can set the price of WETH high enough to create a pool and call sellProfits. As a result, WETH will be exchanged at a more expensive rate and the malicious user will profit.

Impact

Fees that should be distributed to Stakers can be partially stolen by malicious users.

Tools Used

VS Code

Recommendations

Modify function to takes a fee as an argument and can only be called by authorized users.