No Expiration Deadline Leads to Losing a Lot of Funds
Summary
The SmartVaultV3.swap function lacks an expiration deadline, leading to significant losses during token swaps.
Vulnerability Details
In SmartVaultV3.swap, the deadline parameter is currently assigned the value of block.timestamp. This configuration allows the function to process a token swap at any block number, effectively eliminating an expiration deadline.
Impact
The absence of an expiration deadline exposes the SmartVaultV3 contract to manipulation by malicious miners or validators. They could potentially delay transactions until conditions become favorable for personal gain. This vulnerability could result in substantial fund losses due to slippage.
Tools Used
Manual Review
Recommendations
To mitigate this risk, it is advisable to set a specific and appropriate timestamp as the deadline parameter.
Lead Judging Commences
deadline-check-low
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.