Beedle - Oracle free perpetual lending

Summary

The function sellProfits will selling _profits to WETH through swap router but missing a _profits token approval for the router which will cause the transaction revert.

Vulnerability Details

The function sellProfits will selling _profits to WETH through swap router, and this operation should authorize the swap router spending _profits token, more specifically sending the profit token to the pool and swapping.

However, there is no authorize/approval operation before invoking the swapRouter.exactInputSingle(params); at L42, which will cause the transaction revert.

Impact

The missing token approval will cause the selling profit transaction revert.

Tools Used

Manual

Recommendations

Recommend adding token approval operation before the swapRouter.exactInputSingle.