`block.timestamp` used as deadline for a swap
Summary
block.timestamp is used as a deadline in swap function in SmartVaultV3.
Vulnerability details
Passing block.timestamp as deadline parameter allow malicious miner to hold the transaction for as long as they like, which may be until they are able to cause the transaction to incur the maximum amount of slippage allowed by the slippage parameter (slippage parameter is set to zero in some cases in this codebase).
Impact
This offers no protection as block.timestamp will have the value of whichever block the txn is inserted into, hence the txn can be held indefinitely by malicious validators.
Tools used
VScode, Manual Review
Recommendations
Allow user to parameterize deadline parameter of swap.
Lead Judging Commences
deadline-check-low
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.