Fees.sol uses exactInputSingle() Uniswap SwapRouter which allows only for single hop swap
Summary
exactInputSingle() of Uniswap SwapRouter allows only for single hop swap. Since Fees.seelProfits() allows for any ERC20 tokens, the pool of token pair might not be available on Uniswap.
Vulnerability Details
0xTingle said that the protocol could be deployed on other EVM chains. Therefore BSC could be an option and Uniswap V3 has only an ETH/WETH pool for example on BSC. Same for Arbitrum on which Uniswap V3 has very few WETH pools.
See Uniswap pools info
So with a single hop swap only option, the user funds can be stuck in Fees.sol if Uniswap doesn't have the right pool for the token pair.
Impact
User funds can be stuck in the contract.
Tools Used
Manual review
Recommendations
Use official Uniswap ISwapRouter instead of the custom one actually used and add in Fees.sol the option for multihop swap.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.