The Standard

Summary

The deadline parameter passed to ISwapRouter.ExactInputSingleParams is not effective and the transaction might be left hanging in the mempool and be executed way later than the user wanted at a possibly worse price.

Vulnerability Details

The SmartVaultV3 contract allows users to swap their collateral for a different token through the UniswapV3 SwapRouter. For example, this means that if a user deposited ETH as collateral it can swap it to wBTC or any other supported token directly within the vault.

However, the deadline is hardcoded to block.timestamp. The deadline parameter enforces a time limit by which the transaction must be executed otherwise it will revert.

Let's take a look at the checkDeadline modifier that is present in the function which is called in the SwapRouter contract:

Now when the deadline is hardcoded as block.timestamp, the transaction will not revert because the require statement will always be fulfilled by block.timestamp == block.timestamp.

If a user chooses a transaction fee that is too low for miners to be interested in including the transaction in a block, the transaction stays pending in the mempool for extended periods, which could be hours, days, weeks, or even longer.

This could lead to users getting a worse price because a validator can just hold onto the transaction.

Impact

If the transaction stays for too long in the mempool before the swap is executed, the price for the swap could be much worse leading to a loss for the user.

Tools Used

Manual Review

Recommendations

Use a user-supplied deadline instead of block.timestamp.