Beedle - Oracle free perpetual lending

Summary

Using block.timestamp as deadline parameter in sellProfits() during interaction with uniswap router which suggests that whenever the miner decides to include the transaction in a block, it will be valid at that time, since block.timestamp will be the current timestamp.

Vulnerability Details

block.timestamp in deadline parameter suggests that whenever the miner decides to include the transaction in a block, it will be valid at that time, since block.timestamp will be the current timestamp.

Impact

It may be more profitable for a miner to deny the transaction from being mined until the transaction incurs the maximum amount of slippage.
A malicious miner can hold the transaction as deadline is set to block.timestamp which means that whenever the miner decides to include the transaction in a block, it will be valid at that time, since block.timestamp will be the current timestamp. The transaction might be left hanging in the mempool and be executed way later than the user wanted. The malicious miner can hold the transaction and execute the transaction only when he is profitable and no error would also be thrown as it will be valid at that time, since block.timestamp will be the current timestamp.

Tools Used

Code inspection

Recommendations

Add deadline arguments to ISwapRouter functions that interact with uniswap v3 router, and pass it along to ISwapRouter calls.