Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-24·

`updateDexConfig()` in `poolAdminFacet` ignores pair-specific DEX fees

Not reportedoptionsleverageblack-scholes
TL;DR

The updateDexConfig() function in PoolAdminFacet sets a single fee value per DEX router address:

Severity
LOW
Method
MManual review
CAT.

The updateDexConfig() function in PoolAdminFacet sets a single fee value per DEX router address:

solidity
function updateDexConfig(address router, uint24 fee, bool isValid)
external
onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE)
{
PoolStorage.Dex storage dex = PoolStorage.layout().setUp.dex;
dex.valid[router] = isValid;
@> dex.fee[router] = fee;
emit DexUpdated(router, isValid, fee);
}

However, this structure fails to accommodate DEXes like Uniswap V3, which supports multiple pools per token pair with different fees (e.g., 500, 3000, 10000). Using a single fee for all swaps on a given router can result in a revert or higher slippage in _swapAssetToAsset function.

Recommendations:

Update the design to allow pair-specific fee configuration.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-24