The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of deadline check in `SmartVaultV3::swap`

carlitox477

Description

ISwapRouter.exactInputSingle considers the timestamp of the current block as the deadline. This enables the validator to hold the transaction until it becomes advantageous due to certain market conditions (e.g., slippage or executing their transaction before and frontrunning the original swap).

Impact

Having the ability to customize a deadline enables users to ensure that their transaction will not be 'saved for later'.

By enforcing the deadline to match the timestamp of the block when this transaction is executed, the protocol allows validators to reject the transaction and include it only when they find it more advantageous."

Recommended mitigation

function swap(
bytes32 _inToken,
bytes32 _outToken,
uint256 _amount,
+ uint256 _deadline
) external onlyOwner {
// Fee to pay
uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
// Token to exchange
address inToken = getSwapAddressFor(_inToken);
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
tokenIn: inToken,
tokenOut: getSwapAddressFor(_outToken),
fee: 3000,
recipient: address(this),
- deadline: block.timestamp,
+ deadline: _deadline,
amountIn: _amount - swapFee,
amountOutMinimum: minimumAmountOut,
sqrtPriceLimitX96: 0
});
inToken == ISmartVaultManagerV3(manager).weth() ?
executeNativeSwapAndFee(params, swapFee) :
executeERC20SwapAndFee(params, swapFee);
}
Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

deadline-check-low

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

deadline-check

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!