# UniswapV2TokenAdapter does not support Sushiswap-only assets

UniswapV2TokenAdapter.supports returns false when Uniswap liquidity is low, never checking Sushiswap, so an attacker can grief Sushiswap-only assets by creating an empty Uniswap pair.

- Payout: Audit contest
- Severity: medium
- Program: Mochi
- Found by: cmichel
- Disclosed: 2021-11-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-mochi-findings/issues/135
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-mochi%3AM-09
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** UniswapV2TokenAdapter.supports / aboveLiquidity liquidity check
**Root cause:** aboveLiquidity returns early on the Uniswap branch whenever liquidity is below minimumLiquidity, so the Sushiswap fallback is only reached when the Uniswap call reverts, not when it returns low liquidity.
**Steps:**
1. Call `Router.setPriceSource` for a Sushiswap-only asset pair.
2. Attacker creates an empty UniswapV2 pair for the same token pair with no liquidity.
3. `UniswapV2TokenAdapter.supports` calls `aboveLiquidity`, which hits the Uniswap `getLiquidity` success branch and returns `convertToValue(liq, price) >= minimumLiquidity` = false.
4. Sushiswap branch is never evaluated despite ample Sushiswap liquidity; adapter is rejected.
**How found:** Code reading of the try/catch structure in aboveLiquidity: noticed the early return on the Uniswap success path means the Sushiswap fallback only triggers on revert, not on insufficient liquidity.
**Exploitation:** Attacker pre-creates a zero-liquidity UniswapV2 pair for the target token pair, causing supports() to return false and blocking the Sushiswap pool from being registered as a price source.
**Insight:** In try/catch fallback patterns, check whether the success branch's return value short-circuits the fallback; a low-but-successful result from the first source can mask a valid second source, and an attacker can force that first-source state cheaply (e.g. empty pair creation).