ctf_sec - sqrtPriceLimitX96 parameter is hardcoded to 0 in UniV3Adapter.sol

[sherlock-admin]

ctf_sec

medium

sqrtPriceLimitX96 parameter is hardcoded to 0 in UniV3Adapter.sol

Summary

sqrtPriceLimitX96 parameter is hardcoded to 0 in UniV3Adapter.sol

Vulnerability Detail

sqrtPriceLimitX96 parameter is hardcoded to 0 in UniV3Adapter.sol

        ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams(
            trade.sellToken == Deployments.ETH_ADDRESS ? address(Deployments.WETH) : trade.sellToken, 
            trade.buyToken == Deployments.ETH_ADDRESS ? address(Deployments.WETH) : trade.buyToken, 
            data.fee, 
            from, 
            trade.deadline, 
            trade.amount,
            trade.limit, 
            0 // sqrtPriceLimitX96
        );

I production, sqrtPriceLimitX96 can be used to set the limit for the price the swap will push the pool to, which can help protect against price impact or for setting up logic in a variety of price-relevant mechanisms

Impact

sqrtPriceLimitX96 is basically max slippage you'll allow in the swap. If you're swapping t0 for t1 it needs to be higher than the current sqrtPriceLimitX96, lower if you're swapping the other way.

The Uniswap V3 introduce the concept of centralized liquidity with price range. Setting sqrtPriceLimitX96 dynamically can help protect against price impact and protect user from unexpected from slippage.

Source: https://ethereum.stackexchange.com/questions/121178/how-to-trade-directly-with-uniswap-v3-pool-instead-of-through-router

Code Snippet

https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/trading/adapters/UniV3Adapter.sol#L20-L30

Tool used

Manual Review

Recommendation

We recommend the project allow users to pass in the parameter sqrtPriceLimitX96

      // other parameter
      trade.amount,
      trade.limit, 
      trader.priceLimit // sqrtPriceLimitX96
)