The Standard

Summary

In the swap() function of the SmartVaultV3 contract, the Uniswap fee is hardcoded as 3000 ~ 0.3% which significantly reduces the possibilities of the swap and will lead to non-optimal routes. In particular, all swaps using the ETH path will use the wrong pool as it will, for example, use the ETH / USDC .3% pool due to the hardcoded 3000 fee.

Vulnerability Details

Impact

For example, at the time of writing this report, ETH / WBTC the optimal route is currently ETH -> WETH -> BTC, and the pool ETH / WBTC has 0.15% (USD 3.4) fee which is 50% less when compared to the hardcoded one with 3000 ~ 0.3% (USD 6.8) for a basic swap. Therefore, using the current implementation would create a significant loss of funds.

Here's a link to a screenshot for the swap routes backing up this issue:
https://imgur.com/HSa6mMd

Tools Used

Manual review

Recommendations

Classic mitigation would be to set in advance the best Uniswap paths in a mapping for the supported assets for example ETH > WBTC, then use this data for the swaps. This allows for complex routes that save gas costs as you would also avoid limiting all swaps to a single pool like the code currently does.