MorpheusAI

Summary

The L2TokenReceiver::swap() does not set an expiration deadline, resulting in losing a lot of funds when swapping tokens.

Vulnerability Details

The deadline parameter in the swap() is set to block.timestamp. That means the function will accept a token swap at any block number (i.e., no expiration deadline).
https://github.com/Cyfrin/2024-01-Morpheus/blob/main/contracts/L2TokenReceiver.sol#L60

Impact

Without an expiration deadline, a malicious miner/validator can hold a transaction until they favor it or they can make a profit. As a result, the L2TokenReceiver contract can lose a lot of funds from slippage.

Tools Used

Manual Review

Recommendations

I recommend setting the deadline parameter with a proper timestamp.