DittoETH

Summary

Functions, such as createAsk, createBid, and createLimitShort, within a smart contract that lacks a crucial deadline parameter. This parameter is commonly used to protect users from unexpected delays in transaction execution and sudden price fluctuations.

Vulnerability Details

Protocols like Uniswap offer users the ability to set a deadline parameter when swapping tokens. This feature safeguards users against their transactions lingering in the mempool and executing at an unforeseen time, which could result in financial losses.

Deadline: The Unix time after which a swap will fail, serving as protection against prolonged transaction delays and sudden price fluctuations.

If a user submits a transaction but the gas price increases due to high demand, their transaction may remain in the mempool for an unexpected duration. Over time, the gas price could decrease, making the user's transaction eligible for validators to include in the next block. However, the asset price may have already changed, resulting in the user's order being executed at a less favorable price.

However, the createAsk, createBid, and createLimitShort functions lack this parameter. This omission could potentially lead to the unintended execution of transactions in the future, exposing users to the risk of losing their tokens.

Impact

Users may encounter unexpected execution of their transactions at an inopportune moment, potentially leading to the loss of their funds.

Tool Used

Manual Review

Recommendation

Provide users with the option to specify a deadline parameter when utilizing the createAsk, createBid, or createLimitShort functions.