The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`SmartVaultV3::swap` `Block.timestamp` deadline can lead to loss of funds during swaps

DarkTower

Summary

The SmartVaultV3::swap() function uses block.timestamp as the deadline which is literally no deadline and can lead to loss of funds during token swaps.

Vulnerability Details

function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC(); // returns swap fee
address inToken = getSwapAddressFor(_inToken); // retuns address of inToken
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
tokenIn: inToken,
tokenOut: getSwapAddressFor(_outToken),
fee: 3000,
recipient: address(this),
@> deadline: block.timestamp,
amountIn: _amount - swapFee,
amountOutMinimum: minimumAmountOut,
sqrtPriceLimitX96: 0
});
inToken == ISmartVaultManagerV3(manager).weth() ?
executeNativeSwapAndFee(params, swapFee) :
executeERC20SwapAndFee(params, swapFee);
}

The deadline parameter in the swap() function being set as block.timestamp enforces the user or msg.sender will have to accept a token swap at any block number (i.e., deadline of infinity).

Impact

Without a realistic deadline, swaps can be held until the price no longer favors the user thereby resulting in a loss for the user as they would happen in unfavorable price points. Due to this, user vaults can lose significant amount of funds from slippage during swaps.

Tools Used

Manual review

Recommendations

We recommend adding a parameter deadline with a proper timestamp in the function that would be chosen by the user or is determined off-chain.

Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

deadline-check-low

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline-check

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!