116.md

Dizzy Slate Deer

Medium

Incorrect route struct usage for velo pools

Summary

According to the docs at https://sticky-yarrow-52e.notion.site/AXION-Audit-Documentation-11bb3e443073802c949bd3700abad968 and the presence of the AerodromeUtils.sol contract, aerodrome/velodrome pools are intended to be supported. However there is a peculiarity in those contracts which can break functionality.

This contract implements the route struct similar to how most solidly forks implement it as shown below.

https://github.com/sherlock-audit/2024-10-axion/blob/main/liquidity-amo/contracts/interfaces/v2/ISolidlyRouter.sol#L5-L9

The issue is that for velodrome and aerodrome, this struct needs an extra factory address.

Velodrome on OP: https://optimistic.etherscan.io/address/0xa062aE8A9c5e11aaA026fc2670B0D65cCc8B2858#code Aerodrome on base: https://basescan.org/address/0xcF77a3Ba9A5CA399B7c97c74d54e5b1Beb874E43#code

struct Route {
    address from;
    address to;
    bool stable;
    address factory;
}

Due to this difference, the contract wont work with velodrome pools. The devs clearly mentioned that velo support is intended, thus this is an issue.

Root Cause

The velodrome pools implement the route struct differently, with an added factory address. This differs from the contracts here, breaking compatibility.

Internal pre-conditions

None

External pre-conditions

None

Attack Path

None

Impact

Broken compatibility with velodrome and aerodrome pools

PoC

None

Mitigation

For velodrome/aerodrome interactions, implement a different contract which handles the different router struct.