Submission Details
Severity:
No expiration deadline leads to losing a lot of funds
Summary
The SmartVaultV3::swap does not set an expiration deadline, resulting in losing a lot of funds when swapping tokens.
Vulnerability Details
The deadline parameter in the sellProfits() is set to block.timestamp. That means the function will accept a token swap at any block number (i.e., no expiration deadline).
Impact
Without an expiration deadline, a malicious miner/validator can hold a transaction until they favor it or they can make a profit. As a result, the user can lose a lot of funds from slippage.
Tools Used
Manual Review
Recommendations
I recommend setting the deadline parameter with a proper timestamp.
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
deadline-check-low
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.