The Standard

Summary

Hardcode or fixed fee is used while swapping tokens on uniswap

Vulnerability Details

swap() funtion in SmartVaultV3.sol contract is used to swap tokens one token to another token by owner of contract. The fee for swap is hardcoded to 3000 which is 0.3%.

Per uniswap v3,

Uniswap v3 introduces multiple pools for each token pair, each with a different swapping fee. Liquidity providers may initially create pools at three fee levels: 0.05%, 0.30%, and 1%. More fee levels may be added by UNI governance,

However, not all pools in Uniswap are created with fee level being 3000 or 0.3%.

This example may not be relevant to protocol but for issue understanding, for example,

1. fee level of XMON / ETH (0x59b4bb1f5d943cf71a10df63f6b743ee4a4489ee) on Mainnet is 10000 (1%),

2. fee level of WETH / BOB (0x1a54ae9f662b463f8d432482975c17e51518b50d) on Optimism is 500 (0.05%).

Therefore, fee should not be hardcoded while swapping tokens.

Impact

Using fixed or hardcoded fee when swap tokens may be failed if the pool swap fee is changed via governance and there would be no way to change the hardcoded fee result in redeployment of contract.

Tools Used

Manual review

Recommendations

Pass the fee as input param while swapping, alternatively a fee setter function can be introduced to update the fee variable as required in future.