Assessment reports>SushiSwap RouteProcessor3>Threat Models>uniswapV3SwapCallback

Function: uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, byte[] data)

This function implements the IUniswapV3SwapCallback interface. It is called by UniswapV3 when executing a swap to request a transfer of the collateral for a swap.

Inputs

  • amount0Delta

    • Control: Arbitrary.

    • Constraints: Arbitrary.

    • Impact: If positive, it determines the amount of the first asset in the pair that must be sent to the pool.

  • amount1Delta

    • Control: Arbitrary.

    • Constraints: Arbitrary.

    • Impact: If positive, it determines the amount of the second asset in the pair that must be sent to the pool.

  • data

    • Control: Arbitrary.

    • Constraints: Must encode an address.

    • Impact: Determines the address of the token to be sent to the pool (this data is supposed to be originally provided to Uniswap by RP3).

Branches and code coverage (including function calls)

Intended branches

  • The requested amount is sent to the pool.

Negative behavior

  • The caller is not the expected Uniswap pool.

  • The requested amount is negative and causes a revert.

Function call analysis

  • uniswapV3SwapCallback -> IERC20(tokenIn).safeTransfer(msg.sender, uint256(amount))

    • What is controllable?: amount.

    • If return value controllable, how is it used and how can it go wrong?: Not used.

    • What happens if it reverts, reenters, or does other unusual control flow?: The revert is bubbled up, as intended.

Zellic © 2024Back to top ↑