Skip to content
Request an audit

‹ All findings

uniTransfer() limits the gas limit to 5k in outdated 1inch solidity-utils lib

Low/Info1inch Fee Extension·Sherlock · DEX aggregator · 14th April, 2025L-2

Summary

UniERC20::uniTransfer() limits the gas to 5k in the solidity-utils lib version 6.3.0.

Vulnerability Detail

See the version used in the current commit of the protocol here.

The solidity-utils lib has been updated in 6.4.0 and now forwards all gas, which means that the only fix needed is bumping this version in the package.json file.

Impact

Sweeping could fail due to this limitation. Another owner would have to be used, that most likely can not be a multisig so it could be a problem.

Code Snippet

https://github.com/sherlock-audit/2025-04-1inch/blob/main/limit-order-protocol/contracts/extensions/FeeTaker.sol#L97-L99

Tool Used

Manual Review

Recommendation

Bump the solidity utils version to the latest.