Beedle - Oracle free perpetual lending

Summary

Fees.sol is the contract that the Lender.sol contract sends the fees it earns. All ERC20 tokens in the Fees.sol contract will be locked forever, because the Uniswap V3 router is not approved to spend any tokens, and thus a swap cannot be performed, and ERC20 tokens can't be transferred out of the contract.

Vulnerability Details

Fees.sol is the contract that the Lender.sol contract sends the fees it earns (otherwise there is no purpose for this contract, and yet the contract itself is vulnerable). It has one function sellProfits, which intends to swap ERC20 tokens to WETH. Although the swap itself is vulnerable to slippage attacks, this is a separate issue, as the issue described in this submission results in locking forever all ERC20 tokens send to Fees.sol. As per Uniswap documentation: The caller must approve the contract to withdraw the tokens from the calling address's account to execute a swap. https://docs.uniswap.org/contracts/v3/guides/swaps/single-swaps Nowhere in the Fees.sol the Uniswap V3 router is approved to spend any ERC20 tokens. The only way tokens are send to another address is trough the sellProfits function:

Since this function will always revert the tokens can't be transferred from the Fees.sol contract.

In the Lender.sol contract there is a function that allows the Fees contract to be changed to a newer one:

This vulnerability can be mitigated in a newer version of the contract, but the funds that were already send to the Fees.sol contract will be lost forever. This is why I have classified this vulnerability as high.

Impact

Funds will be locked forever, and thus lost.

Tools Used

Manual review

Recommendations

Implement an approve function, which approves the Uniswap V3 Router contract to transfer the desired ERC20 token. Or approve the Uniswap V3 router to transfer '_profits' token in the sellProfits function.