Shouldn't use block.timestamp as the deadline when interact with AMM
Summary
When sell profits, user txs may pending in the memory forever becasue protocol use block.timestamp as deadline.
Vulnerability Details
When passing block.timestamp as the deadline parameter to a pool, means that whenever the miner decides to include the tx in a block, it will be valid at that time, since block.timestamp will be the current timestamp. A malicious miner can hold the transaction when there is profitable, so the tx maybe pending in the memory forever.
Impact
Users txs may pending in the memory forever.
Tools Used
vscode, Manual Review
Recommendations
Add deadline parameter when use sellProfits function when interact with AMMs.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.