Return to site
Return to site

Bug Deep Dive #25

Gas consumed in notifyUnsubscribe is underestimated during tests and is greater than 300,000 without pre-warming - $2613

· Bug Deep Dive
Section image

To protect users against bricked positions by malicious subscriber contracts, Uniswap V4 notifier allows recovery of a reverting notifyUnsubscribe call:

Section image

Conversely, in order to protect subscriber against forced failure due to insufficient user gas limit, outer call reverts if less than unsubscribeGasLimit is available, and thus guarantees at least (unsubscribeGasLimit*63)/64 is provided to notifyUnsubscribe call (the 63/64 factor is due to EIP 150).

unsubscribeGasLimit value on Base is set to 300,000.

This is why PositionManagerAdapter.notifyUnsubscribe must keep gas cost under (300,000*63)/64 ~= 295000, to avoid users unsubscribing successfully on Uniswap V4 while leaving positions with liquidity in Deli gauges accounting.

Unfortunately, this is not the case, and the call to notifyUnsubscribe can consume more than 300,000 gas.

Users can force unsubscribe from Uniswap V4, but keep positions accounting intact in Deli gauges.

Then the malicious user can either burn or resubscribe his position to PositionManagerAdapter immediately, diluting the rewards for that range by position liquidity forever (even if the admin calls adminForceUnsubscribe, liquidity remains accounted for in global gauge accounting).

Section image

Alpha: for Uniswap hooks, it only forwards 300k gas at most on Base, and execution continues if it reverts or runs out of gas, and the position no longer becomes attached to the hook.

Conclusion

This finding would earn you $2613, make sure the Uniswap hook doesn't run out of gas on the notifier hook, as it would revert all state changes the hook was supposed to make.

Full Report
Codebase

Subscribe
Previous
Bug Deep Dive #24
Next
 Return to site
Cookie Use
We use cookies to improve browsing experience, security, and data collection. By accepting, you agree to the use of cookies for advertising and analytics. You can change your cookie settings at any time. Learn More
Accept all
Settings
Decline All
Cookie Settings
Necessary Cookies
These cookies enable core functionality such as security, network management, and accessibility. These cookies can’t be switched off.
Analytics Cookies
These cookies help us better understand how visitors interact with our website and help us discover errors.
Preferences Cookies
These cookies allow the website to remember choices you've made to provide enhanced functionality and personalization.
Save