Beedle - Oracle free perpetual lending

Summary

If for any reason the function exactInputSingle from swapRouter reverts, profits of that specific address might be locked forever. For example, Uniswap v3 introduces multiple pools for each token pair, each with a different swapping fee. Liquidity providers may initially create pools at three fee levels: 0.05%, 0.30%, and 1%.

Vulnerability Details

If a specific pool _profits-WETH does not have a 3000 wei fee, the function sellProfits would revert.
Steps to reproduce:

1. Find a WETH-token pool in Optimism's Uniswap V3 Router Contract (Since according to Beedle's dev, they are deploying on Optimism) that does not have a 0.30% fee.

2. Execute sellProfits with the token address that you found in the previous step to see the revert.

Impact

This would cause the contract to lock up that specific token _profits indefinitely and the user would not be able to withdraw the profits, hence it is a High risk vulnerability.

Tools Used

Foundry

Recommendations

1. Implement a function emergencyWithdraw(address _profits) onlyOwner to withdraw any stuck funds.

2. Implement a mapping to track different _profits-WETH pool fees instead of hardcoding 3000.