In this case, the uniswap fee is hardcoded to 100 which corresponds to a 0.01%.
Even though 0.01% seems the cheapest uniswap fee, it may not be the most profitable pool to execute the swap. This can be due to the pool not being intialized, or having low liquidity. Normally for pegged tokens like USDC/DAI the 0.01% fee pool should have enough liquidity to execute a swap and it will be the most profitable one. However, for different tokens the best pool/the best path to execute a swap may not be just as straightforward as choosing the lowest fee pool and executing the swap in there.
Tools Used
Manual review
Recommended Mitigation Steps
Adjusting the fee pool to execute the swaps should be done when creating the power farm knowing which token will be involved. Some research needs to be done to determine which fee pool can provide more outcome given the pool fee, the liquidity and impact that the swap will have into that pool.
It is also worth noting that for some tokens the best swap may be a path with intermediate tokens. For example stETH -> USDC, USDC -> WETH.
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarm/PendlePowerFarmLeverageLogic.sol#L278 https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarm/PendlePowerFarmDeclarations.sol#L95
Vulnerability details
Impact
When someone enters or exits a power farm in Arbitrum chain, a swap between WETH and ENTRY_ASSET is executed:
This function executes this swap in a uniswap pool with a hardcoded fee:
In this case, the uniswap fee is hardcoded to 100 which corresponds to a 0.01%.
Even though 0.01% seems the cheapest uniswap fee, it may not be the most profitable pool to execute the swap. This can be due to the pool not being intialized, or having low liquidity. Normally for pegged tokens like USDC/DAI the 0.01% fee pool should have enough liquidity to execute a swap and it will be the most profitable one. However, for different tokens the best pool/the best path to execute a swap may not be just as straightforward as choosing the lowest fee pool and executing the swap in there.
Tools Used
Manual review
Recommended Mitigation Steps
Adjusting the fee pool to execute the swaps should be done when creating the power farm knowing which token will be involved. Some research needs to be done to determine which fee pool can provide more outcome given the pool fee, the liquidity and impact that the swap will have into that pool.
It is also worth noting that for some tokens the best swap may be a path with intermediate tokens. For example stETH -> USDC, USDC -> WETH.
Assessed type
Uniswap