Submission Details
Severity:
Using block.timestamp as deadline is still dangerous
Vulnerability Details
The contract is using block.timestamp as deadline which can still be exploited by a malicious miner.
See Fees.sellProfits():
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp, //@audit miner can control block.timestamp
amountIn: amount,
amountOutMinimum: 0,
sqrtPriceLimitX96: 0
});
Impact
Protocol shouldn't set the deadline to block.timestamp as a validator can call the sellProfits() (external) and hold the transaction and the block it is eventually put into will be block.timestamp, so this offers no protection.
Tools Used
Manual
Recommendations
Set an actual time deadline for the swap.
More info: https://blog.bytes032.xyz/p/why-you-should-stop-using-block-timestamp-as-deadline-in-swaps
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.