First Flight #18: T-Swap

First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Submission Details
Severity: medium
Valid

Missing deadline check in `TSwapPool:: deposit` allows transactions to complete even after input deadline

Summary

deadline input is not utilized which can leads to user getting less lp tokens during highly volatile market conditions.

Vulnerability Details

Deposit function in TSwapPool has deadline parameter, which is good as mentioned in the docs.
The deadline for the transaction to be completed by. However, this input parameter remains unused during the execution.
Due to this, Users who will deposit assets to the pool at highly volatile market will be affected by getting unfavorable rates.

Impact

Transactions getting executed at unfavourable rates.

Tools Used

Manual Review

Recommendations

It can be fixed by following way -

function deposit(
uint256 wethToDeposit,
uint256 minimumLiquidityTokensToMint,
uint256 maximumPoolTokensToDeposit,
uint64 deadline
)
external
+ revertIfDeadlinePassed(deadline)
revertIfZero(wethToDeposit)
returns (uint256 liquidityTokensToMint)
{
/// other code as is
}
Updates

Appeal created

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`deposit` is missing deadline check causing transactions to complete even after the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.