UniStaker Infrastructure - SpicyMeatball's results

Lines of code

https://github.com/code-423n4/2024-02-uniswap-foundation/blob/main/src/V3FactoryOwner.sol#L181

Vulnerability details

Impact

The user who attempts to buy protocol fees in V3FactoryOwner.sol may lose his funds in a bad deal if claimFees transaction is executed later in time.

Proof of Concept

Users can pay a fixed amount of tokens to purchase protocol fees accumulated in the pool.

  function claimFees(
    IUniswapV3PoolOwnerActions _pool,
    address _recipient,
    uint128 _amount0Requested,
    uint128 _amount1Requested
  ) external returns (uint128, uint128) {
    PAYOUT_TOKEN.safeTransferFrom(msg.sender, address(REWARD_RECEIVER), payoutAmount);
    REWARD_RECEIVER.notifyRewardAmount(payoutAmount);
    (uint128 _amount0, uint128 _amount1) =
      _pool.collectProtocol(_recipient, _amount0Requested, _amount1Requested);

    // Protect the caller from receiving less than requested. See `collectProtocol` for context.
    if (_amount0 < _amount0Requested || _amount1 < _amount1Requested) {
      revert V3FactoryOwner__InsufficientFeesCollected();
    }
    emit FeesClaimed(address(_pool), msg.sender, _recipient, _amount0, _amount1);
    return (_amount0, _amount1);
  }

For this deal to be profitable PAYOUT_AMOUNT should be less than received fees value. Let's take example from the comment below https://github.com/code-423n4/2024-02-uniswap-foundation/blob/main/src/V3FactoryOwner.sol#L157-L166

USDC/USDT pool has accumulated fees which value is 26K USD, Alice calls claimFees(usdc_usdt, alice, 13000 ether, 13000 ether) in order to receive 13K USDT and 13K USDC tokens in exchange for PAYOUT_AMOUNT of 10 WETH that is 10 * 2500 = $25K, the profit is 26K - 25K = $1000.

Now imagine that her transaction was executed with a significant time delay due to network conditions or a low gas amount, and WETH/USD price increased to 2700, this would result in a loss of funds as Alice receives 26K in USDC and USDT tokens in exchange for 10 * 2700 = $27K.

Tools Used

Manual review

Recommended Mitigation Steps

Add the deadline check in claimFees

Assessed type

Timing