Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Hardcoded `fee` value and `swapRouter` address in `Fee` contract

alexzoid

Summary

Uniswap v3 router address and a fee value of 3000 are hardcoded.

Vulnerability Details

The address 0xE592427A0AEce92De3Edee1F18E0157C05861564 is hardcoded as the Uniswap v3 router address. Based on UniswapV3 documentation this address if for Mainnet, Goerli, Arbitrum, Optimism, Polygon. Celo blockchain has another address, will not be supported.

A fee value of 3000 is hardcoded in the ExactInputSingleParams structure within the sellProfits function. Uniswap pools with another fee are not supported.

Impact

Any changes to these values require a modification of the contract code and redeployment.

Tools Used

Manual review

Recommendations

Instead of hardcoding the values, consider parameterizing them through the constructor or configurable methods. This allows for greater flexibility and adaptability to network changes.

event FeeUpdated(uint256 newFee);
​
uint256 public fee = 3000; // Default fee value
​
constructor(address _weth, address _staking, address _swapRouter) {
WETH = _weth;
staking = _staking;
swapRouter = ISwapRouter(_swapRouter);
}
​
function setFee(uint256 _fee) public onlyOwner {
fee = _fee;
emit FeeUpdated(_fee);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.