UniStaker Infrastructure - nnez's results

Lines of code

https://github.com/code-423n4/2024-02-uniswap-foundation/blob/main/src/V3FactoryOwner.sol#L193-L194

Vulnerability details

Description

When calling V3FactoryOwner.sol#claimFees, the _amount0 and _amount1 return from calling _pool#collectProtocol must be equal or greater than amount(0,1)Requested or else the transaction would revert.

However, in the actual implementation of V3Pool (https://github.com/Uniswap/v3-core/blob/main/contracts/UniswapV3Pool.sol#L848)

if (amount0 > 0) {
    if (amount0 == protocolFees.token0) amount0--; // ensure that the slot is not cleared, for gas savings
    ...
    ...

The actual pool#collectProtocol would try to save gas and subtract _amount0 and _amount1 by 1 to prevent storage clearance in the case that the requested amount is equal to current collected protocol fee.

Therefore, calling V3FactoryOwner.sol#claimFees with maximum requested amount will always fail because the return _amount0 and _amount1 will always be off by 1

Recommended Mitigations

The mitigation depends on how you view this issue. (1) Adding note in comment section about this certain case OR (2) Allow off-by-one slippage in claimFees function

Assessed type

Other