Beedle - Oracle free perpetual lending

Summary

The Fees contract never approves the Uniswap router contract. Hence, the swap would always revert.

Vulnerability Details

The sellProfits function calls the Uniswap router's exactInputSingle to swap tokens into WETH. But, this operation would always fail. This is because the Uniswap router is never approved by the Fees contract to transfer tokens from it. It has 0 allowances. So, when Uniswap tries to get tokens from the Fees contract to perform the swap operation, it would always revert because of 0 allowances. Even Uniswap docs recommend the same. Check their example implementation in the docs - https://docs.uniswap.org/contracts/v3/guides/swaps/single-swaps

Impact

Swap operation would always revert.

Tools Used

Manual review.

Recommendations

Approve the Uniswap router before perform the swap operation. Check the uniswap docs.