Beedle - Oracle free perpetual lending

Summary

The fee value should not be hardcoded as a fixed parameter of UniswapV3 pools.

Vulnerability Details

The sellProfits function in the Fees contract is intended to swap accumulated fees on UniswapV3 to WETH and send them to the staking contract. As the pool creator is able to choose an arbitrary token and set it as a loanToken (and the fee is paid in those), for some long-tail assets, the pool with a fee = 3000 may not exist. For the biggest tokens, pools with a fee of 500 are also liquid enough for performing a swap, so the swap would be cheaper using them.

Impact

The underlying fee may not be able to be swapped to WETH and transferred.
The swap may be cheaper using pools with smaller fees.

Tools Used

Manual review

Recommendations

Implement a functionality before making a swap that checks if a pool for the token and WETH exists, starting from the least fee value or provide a fee parameter as a function argument.