Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high

`Fees` contract cannot handle WETH

Bobface

Summary

The Fees contract cannot handle WETH, resulting in WETH being stuck permanently in the contract.

Vulnerability Details

The Fees contract sells accumulated protocol fees on Uniswap V3. Since the protocol is designed to work with all ERC-20 based tokens, this could (and likely will) also include WETH. However, the Fees contract cannot handle WETH, as its only method, sellProfits, reverts when calling it with WETH:

function sellProfits(address _profits) public {
require(_profits != WETH, "not allowed");
// ...
}

Impact

WETH fees earned by the protocol via borrowing or liquidations are permanently stuck in the Fees contract.

Tools Used

None

Recommendations

When sellProfits is called with WETH, simply transfer them directly to the staking contract:

function sellProfits(address _profits) public {
if(_profits == WETH) {
IERC20(WETH).transfer(staking, IERC20(WETH).balanceOf(address(this)))
return;
}
//
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.