Submitted by cmichel
The UniswapV2TokenAdapter.supports function calls its aboveLiquidity function which returns the UniswapV2 liquidity if the pair exists.
If this is below minimumLiquidity, the supports function will return false.
However, it could be that the Sushiswap pair has lots of liquidity and could be used.
Suppose the UniswapV2TokenAdapter wants to be used as an adapter for a Sushiswap pool.
An attacker creates a UniswapV2 pool for the same pair and does not provide liquidity.
The Router.setPriceSource calls UniswapV2TokenAdapter.supports and returns false as the Uniswap liquidity is too low, without checking the Sushiswap liquidity.
In aboveLiquidity, if the UniswapV2 liquidity is less than the minimum liquidity, instead of returning, compare the Sushiswap liquidity against this threshold.
ryuheimat (Mochi) confirmed
