MorpheusAI

Summary

Incorrect implementation of sqrtPriceLimitX96 in L2TokenReceiver.swap

Vulnerability Details

The swap function within the L2TokenReceiver contract employs a single sqrtPriceLimitX96 parameter for executing swaps, which is a critical parameter for determining price limits within Uniswap V3's swapping mechanism. The usage of this parameter is intended to specify a price limit to prevent swaps from occurring at undesirable rates. However, the function's current implementation does not account for the variability and uniqueness of each pool's conditions in Uniswap V3, where multiple pools can exist for each token pair, each potentially requiring a different sqrtPriceLimitX96 value:

In swap function sqrtPriceLimitX96 is used twice to fetch price limit for swapping

Given Uniswap V3's(here) introduction of multiple fee tiers and pools for each token pair, using a single sqrtPriceLimitX96 value for all potential pools may not always be appropriate. This approach disregards the complexity of choosing an optimal pool based on the current state of the pools available for the token pair in question.

Furthermore, the emphasis on sqrtPriceLimitX96 could be redundant given that amountOutMinimum is also checked, serving as a safeguard to ensure that the swap does not result in an output amount lower than expected by the user.

Also, I think it's not mandatory to check a sqrtPriceLimitX96 as it checks amountOutMinimum already. (It checks amountOutMinimum)

Impact

This misuse could cause the swap function to revert or fail under circumstances where it would otherwise succeed if an appropriate sqrtPriceLimitX96 were utilized for the specific pool conditions.

Tools Used

Manual

Recommendations

It is advisable to remove the sqrtPriceLimitX96 parameter from the swap function's implementation if its inclusion does not add value beyond what is already ensured by the amountOutMinimum check. This change simplifies the swapping logic, reduces potential for errors due to misconfiguration of sqrtPriceLimitX96, and enhances the contract's flexibility in interacting with multiple pools