MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

No expiration deadline allows a validator to hold a transaction at will

serialcoder

Summary

The swap() and increaseLiquidityCurrentRange() of the L2TokenReceiver contract do not set expiration deadlines.

Vulnerability Details

The deadline parameters in the swap() and increaseLiquidityCurrentRange() are set to block.timestamp. This means that the functions will accept a transaction at any block number (i.e., no expiration deadline).

function swap(uint256 amountIn_, uint256 amountOutMinimum_) external onlyOwner returns (uint256) {
SwapParams memory params_ = params;
​
ISwapRouter.ExactInputSingleParams memory swapParams_ = ISwapRouter.ExactInputSingleParams({
tokenIn: params_.tokenIn,
tokenOut: params_.tokenOut,
fee: params_.fee,
recipient: address(this),
@1 deadline: block.timestamp, //@audit -- Swap a token with the deadline: block.timestamp. The function will accept a token swap at any block number.
amountIn: amountIn_,
amountOutMinimum: amountOutMinimum_,
sqrtPriceLimitX96: params_.sqrtPriceLimitX96
});
​
uint256 amountOut_ = ISwapRouter(router).exactInputSingle(swapParams_);
​
emit TokensSwapped(params_.tokenIn, params_.tokenOut, amountIn_, amountOut_, amountOutMinimum_);
​
return amountOut_;
}
​
...
​
function increaseLiquidityCurrentRange(
uint256 tokenId_,
uint256 depositTokenAmountAdd_,
uint256 rewardTokenAmountAdd_,
uint256 depositTokenAmountMin_,
uint256 rewardTokenAmountMin_
) external onlyOwner returns (uint128 liquidity_, uint256 amount0_, uint256 amount1_) {
...
​
INonfungiblePositionManager.IncreaseLiquidityParams memory params_ = INonfungiblePositionManager
.IncreaseLiquidityParams({
tokenId: tokenId_,
amount0Desired: amountAdd0_,
amount1Desired: amountAdd1_,
amount0Min: amountMin0_,
amount1Min: amountMin1_,
@2 deadline: block.timestamp //@audit -- Increase liquidity with the deadline: block.timestamp. The function will accept a transaction at any block number.
});
​
(liquidity_, amount0_, amount1_) = INonfungiblePositionManager(nonfungiblePositionManager).increaseLiquidity(
params_
);
​
emit LiquidityIncreased(tokenId_, amount0_, amount1_, liquidity_, amountMin0_, amountMin1_);
}

  • @1 -- Swap a token with the deadline: block.timestamp. The function will accept a token swap at any block number.: https://github.com/Cyfrin/2024-01-Morpheus/blob/07c900d22073911afa23b7fa69a4249ab5b713c8/contracts/L2TokenReceiver.sol#L65

  • @2 -- Increase liquidity with the deadline: block.timestamp. The function will accept a transaction at any block number.: https://github.com/Cyfrin/2024-01-Morpheus/blob/07c900d22073911afa23b7fa69a4249ab5b713c8/contracts/L2TokenReceiver.sol#L112

Impact

Without an expiration deadline, a malicious miner/validator (sequencer) can hold a transaction until they favor it or they can make a profit.

Tools Used

Manual Review

Recommendations

Set the deadline parameters with proper timestamps.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol should not use block.timestamp as deadline in Uniswap interactions because it renders the protection mechanism useless

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.