The Standard

Summary

The SmartVaultV3::swap() does not set an expiration deadline, resulting in losing a lot of funds when swapping tokens.

Vulnerability Details

The deadline parameter in the swap() is set to block.timestamp. That means the function will accept a token swap at any block number (i.e., no expiration deadline).
(https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/SmartVaultV3.sol#L214)
(https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/SmartVaultV3.sol#L223)

Impact

Without an expiration deadline, a malicious miner/validator can hold a transaction until they favor it or they can make a profit. As a result, the Fees contract can lose a lot of funds from slippage.

Tools Used

Manual Review.

Recommendations

I recommend setting the deadline parameter with a proper timestamp.