Swaps in Uniswap V3 may be partial

Lines of code Vulnerability details Swaps in Uniswap V3 may be partial Uniswap V3 pools may execute a swap partially, in which case it may leave an unhandled amount of WETH in the JBXBuybackDelegate contract. Impact Swaps in Uniswap V3 can eventually be executed partially, if liquidity is not...

Verify the correspondence between trading pairs and pools

Lines of code Vulnerability details Impact It may cause the correct ProjectToken to be locked, and transfer the wrong ProjectToken to the beneficiary. Proof of Concept Add test USDC after line 78 in the test file. IERC20 usdc = IERC200xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48; Modify line 142...

Delegate doesn't verify payed ETH value matches amount in parameter

Lines of code Vulnerability details Delegate doesn't verify payed ETH value matches amount in parameter The JBXBuybackDelegate delegate fails to check that the sent ETH amount matches the value passed in the amount parameter. Impact The payable didPay function present in the delegate is called by...

Swap leftovers are locked in the JBXBuybackDelegate

Lines of code Vulnerability details Vulnerability details In case that the project JBToken address is bigger than WETH address, projectTokenIsZero is set to false. The test cases of buyback delegate only cover the situation, where the JBToken is lower than WETH. constructor IERC20 projectToken,...

Partial fill when swapping can cause ETH amount that is difference between _delegateAllocation.amount and _amountToSend to be locked in JBXBuybackDelegate contract

Lines of code Vulnerability details Impact When calling the following JBPayoutRedemptionPaymentTerminal31.pay function, if delegateAllocations.length != 0 is true, delegateAllocation.delegate.didPayvalue: payableValuedata can be executed, which sends delegateAllocation.amount as msg.value to the...

Improper configuration in JBXBuybackDelegate can cause swaps to fail everytime

Lines of code Vulnerability details Impact Improperly configured direction of swap in JBXBuybackDelegate can cause the calls to swap tokens in Uniswap V3 pool to fail everytime. So if the ideal path is token swap over minting, swaps will fail and new project token will be minted instead Proof of...

DoS while calling pay() for the first time when the JBXBuybackDelegate.sol would not have any project's token

Lines of code Vulnerability details Impact 1. Let us assume a user calls the pay function in the JBPayoutRedemptionPaymentTerminal31.sol or the JBETHPaymentTerminal31.sol for the first time. By "for the first time", I mean that the JBXBuybackDelegate.sol does not have any of the project's tokens ...

Missing "if (beneficiaryTokenCount < _minReturnedTokens) revert INADEQUATE_TOKEN_COUNT();" check in the _mint() function of the JBXBuybackDelegate.sol + DoS for the pay() function in the JBPayoutRedemptionPaymentTerminal3_1.sol (or the JBETHPaymentTerminal3_1.sol)

Lines of code Vulnerability details Impact The issue contains 2 parts: 1. The mint function has the "if beneficiaryTokenCount minReturnedTokens revert INADEQUATETOKENCOUNT;" check missing. This check is used to identify whether the beneficiaryTokenCount amount is greater than or equal to the...

ETH CAN GET LOCKED IN THE CONTRACT DURING THE EXECUTION OF _swap() FUNCTION

Lines of code Vulnerability details Impact In the JBXBuybackDelegate delegate contract, if the swap option is selected after comparing the quote, the JBXBuybackDelegate.swap function will swap the data.amount.value amount of ETH in the following pool.swap call. try pool.swap recipient: addressthi...

Contributors will be unable to fund a project if UNISWAP token swapping is recommended over minting in JBXBuybackDelegate data source

Lines of code Vulnerability details Impact A core function of the juice-buyback contract, which is to maximise the project tokens received by the contributor, won't work whenever a swap from Uniswap V3 pool provides more tokens over minting because the transaction will revert. This can cause the...

JBXBuybackDelegate.didPay() allows for positive slippage theft

Lines of code Vulnerability details Impact The JBXBuybackDelegate.didPay calls swap which utilizes the Uniswap's swap function. JBXBuybackDelegate incorporates a negative slippage check in uniswapV3SwapCallback. However, it fails to consider the deadline parameter of the transaction. The deadline...

Should check for _data.amount.value

Lines of code Vulnerability details Impact msg.value is not checked in didPay, if swap is not successful, the eth amount sent back to the terminal is data.amount.value, which is provided by the user. If there is leftover eth in the contract, the fund could be stolen. Proof of Concept Some eth cou...

Always mint 1 wei when _data.preferClaimedTokens is false

Lines of code Vulnerability details Impact File: JBXBuybackDelegate.sol 183 function didPayJBDidPayData calldata data external payable override --skip-- 188 uint256 tokenCount = mintedAmount; 189 mintedAmount = 1; --skip-- 200 if data.preferClaimedTokens --skip-- 206 else 207 mintdata, tokenCount...

The return value of an external transfer call is not checked on the function uniswapV3SwapCallback in the contract named JBXBuybackDelegate

Lines of code Vulnerability details Impact Several tokens do not revert in case of failure and return false. If one of these tokens is used in MyBank, deposit will not revert if the transfer fails, and an attacker can call deposit for free...