MorpheusAI

MorpheusAI
Foundry
22,500 USDC
View results
Submission Details
Severity: medium
Invalid

Use of block.timestamp for deadline of a swap can lead to loss for a user

Summary

swap() function in L2TokenReceiver.sol executes the ISwapRouter.ExactInputSingleParams() function with deadline as block.timestamp.

Since block.timestamp is always relative, using it in any way is equivalent to using no deadline at all. Needs to use a user defined input to effectively enforce any deadline.
Without a deadline, the transaction might be left hanging in the mempool and be executed way later than the user wanted. That could lead to user getting a worse price, because a validator can just hold onto the transaction. And when it does get around to putting the transaction in a block, it'll be block.timestamp, so they've got no protection there.

Vulnerability Details

The deadline of a swap is set to block.timestamp in the swap function. What this means is that a validator can hold the swap transaction and the block the transaction is eventually put into will be the block.timestamp.

By this, validators determine the timeframe within which a swap should be included in a blockchain and not the user.

Impact

This could lead to users getting a worse price, because a validator can just hold onto the transaction. And when it does get around to putting the transaction in a block, it'll be block.timestamp (which is always relative), so they've got no protection there.

Tools Used

Manual Review

Recommendations

Consider allowing function caller to specify swap() with additional deadline input parameter

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol should not use block.timestamp as deadline in Uniswap interactions because it renders the protection mechanism useless

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.