Summary

In the swap function, there are two issues we need to address, the block.timestamp set as expiration deadline and the minimumAmountOut do not provide slippage protection.

Vulnerability Details

Let's tackle first, the block.timestamp set as deadline (line 233), this can be manipulated by the miner and he is free to decide whenever time he chooses to include the swap transaction in a block. Block.timestamp is a moving value like time so it means the deadline is always the current block, therefore in reality there is no deadline set.

Then, let's talk about calculation of minimumAmountOut, this formula simply just provide the minimum token out so it can still maintain the collateral rate after the swap. There is no mention of slippage protection here because it depends solely on the price from chainlink data feed. The problem could happen here is if there is a sudden volatility price, chainlink data feed just provide the price (line 221), and the calculation just simply process it without slippage protection.

Proof of Concept

Consider this scenario

1 User perform a swap transaction with block.timestamp set as deadline and no slippage protection.

2 Since the deadline is block.timestamp, it is dependent on the miner discretion on what block it could be processed.

3 The transaction is already pending in mempool and still waiting to be included in the block for processing.

4 After many blocks have passed, price already change significantly and since there is no slippage protection, the transaction was still processed.

5 After the transaction was processed, the result is no longer what has been expected by the user. The price is sub-optimal and result to bad losses to user.

Impact

For invalid deadline check, it can bring user's trade in unfavorable position since there is no definite deadline.

For missing slippage protection, user has no control in minimum token it can get from the swap eventually result to a bad trade and losses to user.

Tools Used

Manual review

Recommendations

Deadline data should be provided by the input parameter set by user in the form of unix timestamp and not depend on retrieving data from block.timestamp.
You may refer to this site https://www.unixtimestamp.com/ as a reference for input data.

For slippage protection, please provide input parameter set by user so he has control on the minimum output token and not depend solely on the execution of third-party oracle data price feed.