The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

No expiration deadline leads to losing a lot of funds

zanybonzy

Summary

In SmartVaultV3 contract, swap funtion is used to swap tokens, and constructs ISwapRouter.ExactInputSingleParams, using no expiration deadline.

Vulnerability Details

The deadline parameter in the is set to block.timestamp. That means the function will accept a token swap at any block number (i.e., no expiration deadline).

function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
address inToken = getSwapAddressFor(_inToken);
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
tokenIn: inToken,
tokenOut: getSwapAddressFor(_outToken),
fee: 3000,
recipient: address(this),
deadline: block.timestamp, //@note
amountIn: _amount - swapFee,
amountOutMinimum: minimumAmountOut,
sqrtPriceLimitX96: 0
});
inToken == ISmartVaultManagerV3(manager).weth() ?
executeNativeSwapAndFee(params, swapFee) :
executeERC20SwapAndFee(params, swapFee);
}

block.timestamp will have the value of whichever block the transaction is inserted into, hence the transaction can be held indefinitely by malicious validators.miners.
Note also that the calculated minimumAMountOut can be 0 (see the calculateMinimumAmountOut function).

return collateralValueMinusSwapValue >= requiredCollateralValue ?
0 : calculator.eurToToken(getToken(_outTokenSymbol), requiredCollateralValue - collateralValueMinusSwapValue); //@note
}

Impact

Malicious miners can hold the transaction a long as they wish to, and this can lead to tokens being swapped at outdated prices and less yield.

Tools Used

Manual Code Review

Recommendations

Consider a reasonable value to the deadline argument, and let it be updated depending on the chain. For example, Uniswap sets it to 30 minutes on the Etehreum mainnet and to 5 minutes on L2 networks.

Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

deadline-check-low

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline-check

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.