Beedle - Oracle free perpetual lending

Summary

The Fees contract's swap path is hardcoded, resulting in some tokens not being able to be sold.

Vulnerability Details

The Fees contract sells accumulated protocol fees on Uniswap V3. Since the protocol is designed to work with all ERC-20 based tokens, this can result in various kinds of tokens, from stablecoins to highly volatile ones, to be accumulated as fees. However, the Fees contract hardcodes the swap path for every token X as the direct path X -> WETH with 0.3% swap fee.

Some tokens, especially the more volatile ones, might be mainly traded in a pool with another fee, e.g. 1%, meaning the 0.3% pool might have very low liquidity or might not even exist.

Impact

Tokens that are mostly traded in another pool cannot be sold, resulting in them being stuck in the Fees contract.

Tools Used

None

Recommendations

Add an owner-only method that allows overwriting the path used for specific tokens to be sold.