MorpheusAI

Summary

L2TokenReceiver contract doesn't have a mechanism to utilize its balance from withdrawn positions.

Vulnerability Details

• L2TokenReceiver contract is meant to receive the bridged overPlus staked stETH on L1, and utilizing them to farm yield by providing them to a wstETH Uniswap pool.

• This contract has three functions to interact with Uniswap:

  1. increaseLiquidityCurrentRange function that calls Uniswap NonfungiblePositionManager contract to increase liquidity of the created positions.

  2. swap function that interacts with Uniswap SwapRouter to swap contract tokens.

  3. collectFees function that interacts with Uniswap NonfungiblePositionManager to close created positions.

• But it was noticed that L2TokenReceiver contract doesn't have any mechanism to utilize its tokens balance that's accumulated from the closed liquidity positions (by moving them from the contract to the entitled receipients).

Impact

This will render the contract inefficient as it will not be able to utilize the received yield from the created postions

Proof of Concept

L2TokenReceiver contract

Tools Used

Manual Review.

Recommendations

Add a function that enables the contract owner from making external calls, so that he can transfer its balanced to other parties to be utilizied instead of being stuck in the contract.