🔒 Security stuff

.gas-snapshot

@@ -3,12 +3,12 @@ IETest:testBalanceInETH() (gas: 40333)
 IETest:testCommandSendERC0() (gas: 102975)
 IETest:testCommandSendETH() (gas: 69457)
 IETest:testCommandSendUSDC() (gas: 135705)
-IETest:testCommandSwapDAI() (gas: 101758)
-IETest:testCommandSwapETH() (gas: 113623)
-IETest:testCommandSwapForETH() (gas: 123797)
-IETest:testCommandSwapUSDC() (gas: 157117)
-IETest:testCommandSwapUSDCForWBTC() (gas: 165063)
-IETest:testDeploy() (gas: 2636395)
+IETest:testCommandSwapDAI() (gas: 101180)
+IETest:testCommandSwapETH() (gas: 113642)
+IETest:testCommandSwapForETH() (gas: 123350)
+IETest:testCommandSwapUSDC() (gas: 157149)
+IETest:testCommandSwapUSDCForWBTC() (gas: 165100)
+IETest:testDeploy() (gas: 2665273)
 IETest:testENSNameOwnership() (gas: 84066)
 IETest:testIENameSetting() (gas: 8142)
 IETest:testPreviewCommandSendDecimals() (gas: 91972)

foundry.toml

@@ -5,9 +5,6 @@ evm_version = "shanghai"
 optimizer = true
 optimizer_runs = 9_999_999
 
-[profile.via-ir]
-via_ir = true
-
 [fmt]
 line_length = 100
 

src/IE.sol

@@ -28,6 +28,9 @@ contract IE {
     /// @dev Caller fails.
     error Unauthorized();
 
+    /// @dev 0-liquidity.
+    error InvalidSwap();
+
     /// @dev Invalid command form.
     error InvalidSyntax();
 
@@ -318,8 +321,8 @@ contract IE {
     /// @dev Fallback `uniswapV3SwapCallback`.
     /// If ETH is swapped, WETH is forwarded.
     fallback() external payable {
-        uint256 amount0Delta;
-        uint256 amount1Delta;
+        int256 amount0Delta;
+        int256 amount1Delta;
         bool ETHIn;
         bool ETHOut;
         address payer;
@@ -334,12 +337,15 @@ contract IE {
             tokenIn := shr(96, calldataload(add(0x84, 22)))
             tokenOut := shr(96, calldataload(add(0x84, 42)))
         }
+        if (amount0Delta <= 0 && amount1Delta <= 0) revert InvalidSwap();
         (address pool, bool zeroForOne) = _computePoolAddress(tokenIn, tokenOut);
         if (msg.sender != pool) revert Unauthorized(); // Only pair pool can call.
-        if (ETHIn) WETH.safeTransferETH(zeroForOne ? amount0Delta : amount1Delta);
+        if (ETHIn) WETH.safeTransferETH(uint256(zeroForOne ? amount0Delta : amount1Delta));
         ETHIn
-            ? WETH.safeTransfer(msg.sender, zeroForOne ? amount0Delta : amount1Delta)
-            : tokenIn.safeTransferFrom(payer, msg.sender, zeroForOne ? amount0Delta : amount1Delta);
+            ? WETH.safeTransfer(msg.sender, uint256(zeroForOne ? amount0Delta : amount1Delta))
+            : tokenIn.safeTransferFrom(
+                payer, msg.sender, uint256(zeroForOne ? amount0Delta : amount1Delta)
+            );
         if (ETHOut) {
             uint256 amount = WETH.balanceOf(address(this));
             IWETH(WETH).withdraw(amount);
@@ -348,7 +354,9 @@ contract IE {
     }
 
     /// @dev ETH receiver fallback.
-    receive() external payable {}
+    receive() external payable {
+        if (msg.sender != WETH) revert Unauthorized();
+    }
 
     /// @dev Computes the create2 address for given token pair.
     function _computePoolAddress(address tokenA, address tokenB)