# Swapper mechanism cannot incentivize ETH-WETH swaps without risking owner funds

UniV3OracleImpl applies scaledOfferFactor overrides to sorted/converted ETH-as-WETH pairs, so ETH-WETH swaps can't be incentivized without paying bots for no-op swaps.

- Payout: Contest reward
- Severity: medium
- Program: Splits
- Credited: obront
- Disclosed: 2023-04-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-splits-judging/issues/60
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-splits%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** UniV3OracleImpl / Swapper flash() quote override logic
**Root cause:** Pair overrides (scaledOfferFactor) are keyed on sorted, ETH->WETH-converted quote pairs rather than the actual base/quote token addresses, making ETH and WETH indistinguishable for override lookup.
**Steps:**
1. Owner configures Swapper with $tokenToBeneficiary = ETH and sets WETH-WETH override scaledOfferFactor to 0% to avoid paying no-op swaps.
2. Call flash() with a base token held by contract and quote token ETH.
3. Oracle _convert() maps ETH->WETH and _sort() orders the pair, so override lookup hits the WETH-WETH entry.
4. Result: 0% discount applies, no incentive for bots to swap WETH->ETH; conversely keeping ~5% pays bots for ETH->ETH no-ops.
**How found:** Code reading of UniV3OracleImpl: noticed _convert() and _sort() are applied before _getPairOverride(), so override keys are the converted/sorted pair, not the real tokens.
**Insight:** When override/config lookups key on a normalized (sorted/converted) form of an asset pair, check whether distinct assets collapse to the same key (ETH vs WETH) and whether that breaks per-pair configuration semantics.