MorpheusAI

Summary

The protocol is using a hardcoded block.timestamp as a deadline parameter when interacting with the Uniswap's NonfungiblePositionManager, as well as when interacting with Uniswap's swap router which completely defeats the purpose of having a deadline parameter.

Vulnerability Details

Actions in the Uniswap's NonfungiblePositionManager as well as the SwapRouter contracts are governed by a deadline parameter to prevent the execution of pending transactions which are outdated. Functions that modify the liquidity of the pool check this parameter against the current block timestamp in order to discard transactions which have expired.

Failure to provide a proper deadline value enables pending transactions to be maliciously executed at a later point. Transactions that provide an insufficient amount of gas and are not executed in the current or next blocks, can be picked by malicious actors or MEV bots and executed later in detriment of the person who initiated them.

We can see two instances of it used here:

And here:

Impact

Transactions which use block.timestamp as a deadline parameter, use an ineffective deadline parameter which won't prevent transactions to be maliciously executed at a later stage.

Tools Used

Manual Review

Recommendations

Don't hardcode the deadline parameter, allow for it to be passed as an argument and later forward it to the two contracts.