Submitted by 0xStalin, also found by bin2chen and rvierdiiev
Collateral can be locked and lost in the Strategy contract.
When harvesting a strategy and adjusting the debt to maintain the loan to value of the strategy, the strategy does the following steps:
The problem identified on this report is caused due to some issues in the steps 4 & 6. Lets dive into it.
The first part of the problem is caused due to how the UniQuoter is invoked. The fee of the pool that is sent to the UniQuoter is hardcoded to be 500, which represents a pool of (0.05% fee). This can cause two problems:
StrategyLeverage._payDebt() function
Now comes the second part of the problem, the Strategy checks if there is any leftover collateral after the swap, and if there is any, it does a self transfer for the leftover amount. This can cause one of these two problems:
UseSwapper._swap() function
To recapitulate the most important points, the biggest impact because of the two problems on steps 4 & 6 is when the UniPool configured for the strategy uses a lower fee than 0.05% (500). In this case, the leftover collateral after doing the EXACT_OUTPUT swap for the required amount of WETH to repay the flashloan will be left and locked in the Strategy.
Manual Audit, Uniswap Pools Explorer, & UniV2Quoter contract
To address this problem, Id recommend to apply the two below suggestions.
0xleastwood (judge) decreased severity to Medium and commented:
0xStalin (warden) commented:
0xleastwood (judge) increased severity to Medium and commented:
hvasconcelos (BakerFi) confirmed
ickas (BakerFi) commented:
