Summary

Profits can get stuck in Fees contract, in case there' no 0.3% pool to swap in.

Vulnerability Details

The _sellProfits function is only way to sell profits in the contract to WETH. However, the swap in UniV3 Router forces the swap path to be via 0.3% pool of the profit token and WETH, which may not exist (or have really low liquidity). This means the swap can have very very price impact, or not even possible at all if the pool doesn't exist --> so the profits will get stuck in the contract forever.

Impact

Either

• Really high price impact if the underlying pool has really low liquidity, OR

• Profits get stuck in the contract forever

Tools Used

Manual Review

Recommendations

• Not fix the swap path to the 0.3% pool, or add certain checks to verify the existence of the 0.3% pool.

• Add other ways to withdraw profit tokens in case the swap cannot happen.