Unauthenticated remove liquidty function

[code423n4]

Handle

ad3sh_

Vulnerability details

Impact

Anyone can call removeLiquidity function and remove the liquidity from contract
https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/DexHandlers/UniswapHandler.sol#L221

Contract is not validating or checking the users wallet LP
https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/DexHandlers/UniswapHandler.sol#L222

Attacker can drain the pool by calling remove liquidity

Proof of Concept

https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/DexHandlers/UniswapHandler.sol#L221
while removing the liquidty the function should validate the user's wallet address who is removing the liquidity

second uniswap- handler is calculating price through reservers it may lead price manipulation

Tools Used

Manual

Recommended Mitigation Steps

Add proper fix and validation make functions authentic
use chainlink and weighted geometric mean solution for pricing

[0xScotch]

#120

[0xScotch]

All above mentions are erroneous and have been corrected.

[GalloDaSballo]

The UniswapHandler is just a utility contract that deposits for the msg.sender and sends funds to it
Calling withdraw would just revert as the contract has no balance

[GalloDaSballo]

Marking as invalid