Summary

Unlimited slippage in Fees.sellProfits() as amountOutMinimum: 0

Vulnerability Details

Setting amountOutMinimum: 0 means that the caller is happy to accept 0 output tokens for their supplied input tokens; this exposes the swap to unlimited slippage from sandwich attacks.

Impact

Fees.sellProfits() exposed to unlimited slippage, can swap supplied input tokens for 0 output tokens.

Tools Used

Manual

Recommendations

Allow caller to specify slippage parameter. UniswapV3 docs warn about this: "amountOutMinimum: we are setting to zero, but this is a significant risk in production. For a real deployment, this value should be calculated using our SDK or an onchain price oracle - this helps protect against getting an unusually bad price for a trade due to a front running sandwich or another type of price manipulation"