Hardcoded `block.timestamp` deadline in `Fees.sol` can lead to transaction execution at an unfavorable price
Summary
In Fees.sol, the block timestamp has been hardcoded as the ExactInputSingleParams deadline, which can cause the transaction to execute at an undesired price, leading to a potential loss of funds.
Vulnerability Details
In Fees.sol:36, the code assigns the block timestamp as the deadline in the ISwapRouter.ExactInputSingleParams object. This means that the transaction is coupled to the block inclusion time, which is determined by the validator. The transaction may consequently remain in the mempool until a validator includes it in a new block, and by then, the price associated with the transaction may not be as initially intended, potentially causing loss of funds. Using a hardcoded block.timestamp effectively means no deadline.
Impact
Potential loss of funds in case the execution of the transaction happens at an unfavorable price.
Tools Used
Manual Review
Recommendations
To mitigate this vulnerability, it is recommended to enable the user to provide the deadline.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.