Submitted by WatchPug, also found by Meta0xNull
When a caller calls ChiefTrader.sol#swapExactInput(), it will call ITrader(traderAddress).swapExactInput().
https://github.com/code-423n4/2021-12-mellow/blob/6679e2dd118b33481ee81ad013ece4ea723327b5/mellow-vaults/contracts/trader/ChiefTrader.sol#L59-L59
However, in the current implementation, inputToken is not approved to the traderAddress.
For example, in UniV3Trader.sol#_swapExactInputSingle, at L89, it tries to transfer inputToken from msg.sender (which is ChiefTrader), since its not approved, this will revert.
Plus, the inputToken should also be transferred from the caller before calling the subtrader.
https://github.com/code-423n4/2021-12-mellow/blob/6679e2dd118b33481ee81ad013ece4ea723327b5/mellow-vaults/contracts/trader/UniV3Trader.sol#L89-L89
The same problem exists in swapExactOutput():
https://github.com/code-423n4/2021-12-mellow/blob/6679e2dd118b33481ee81ad013ece4ea723327b5/mellow-vaults/contracts/trader/ChiefTrader.sol#L63-L75
Approve the inputToken to the subtrader and transfer from the caller before calling ITrader.swapExactInput() and ITrader.swapExactOutput().
Or maybe just remove support of swapExactInput() and swapExactOutput() in ChiefTrader.
MihanixA (Mellow Protocol) confirmed:
