The Standard

Summary

SmartVaultV3.swap() function lacks a user-defined deadline parameter, enabling pending transactions to be executed maliciously at a later time

Vulnerability Details

The absence of user defined deadline parameter prevents users from specifying a time limit for executing swaps or liquidity adjustments in the A and B are two collateral tokens

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/SmartVaultV3.sol#L214

Consider the scenario:

1. Alice initiates a swap of x(A) tokens for y(B) tokens, intending to later sell y(B) for x*10(A) tokens.

2. Alice's transaction remains pending in the mempool due to a low transaction fee, delaying its inclusion in a block for an extended period.

3. When network conditions favor her transaction's inclusion, the swap executes. However, the price of token B may have significantly changed, resulting in a much lower A value for y(B). Alice suffers a loss due to the unforeseen trade execution.

Even worse, malicious exploitation via Miner Extractable Value (MEV):

1. The pending swap transaction is awaiting execution in the mempool while token prices soar. Alice's transaction, previously uninteresting due to high fees, becomes profitable for miners to include.

2. The outdated maximum slippage value in the transaction parameters allows for considerable slippage. A MEV bot identifies this and sandwiches Alice, generating substantial profits for the bot at Alice's expense.

Impact

1. pending transactions can be maliciously executed at a later point

2. this swap is used for swaping the tokens to increase the collateral to mint more euors or to be safe from liquidation but this issue can lead to liquidation of vault

Tools Used

Manual

Recommendations

add a proper deadline param instead of just block.timestamp