Summary

amountOutMinimum parameter of Uniswap V3 function is set to zero, leading to a loss of funds.

Vulnerability Details

Impact

AmountOutMinimum is used to specify the minimum amount of tokens to be returned from a swap. Setting amountOutMinimum to zero tells the Uniswap that the caller will accept a minimum of 0 output tokens from the swap, opening up the user to a huge loss of funds via MEV bot sandwich attacks. Such bots are very active on all popular EVM-compatible chains leading to almost 100% sure loss of funds on every call of sellProfits() function of Fees contract.
Learn more about the sandwich attacks here: https://medium.com/coinmonks/defi-sandwich-attack-explain-776f6f43b2fd

Tools Used

Manual Analysis

Recommendations

Set the amountOutMinimum parameter to a non-zero value to prevent MEV sandwich attacks. Use an oracle or other data source to choose a safer value for amountOutMinimum.