SmartVaultV3::swap() provides a hardcoded value for the Uniswap fee, yet certain Uniswap pools may not be available for that fee tier
Summary & Vulnerability Details
For the fee parameter, a constant value of 3000 (0.3% fee tier) is used, however, not all allowed token pairs (present and future additions to the Standard protocol) may be available on Uniswap for this fee tier.
Impact
The token pair provided for the swap may not be available on Uniswap for the hardcoded 0.3% fee tier.
Tools Used
Manual Review
Recommendations
Make the fee parameter configurable. By default, the fee value can be 3000, but the user still should have the possibility to change this parameter in case Uniswap does not provide a token pair for that fee value.
Add an additional argument to the swap() function: uint256 uniswapFee and use it for the "fee" parameter in ExactInputSingleParams
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.