First Flight #18: T-Swap

Summary

The deadline input which is meant to tell the time till the functioning has to be completed is not used in TSWapPool::deposit

Proof of Code

PoC

function testDeposit() public {

vm.startPrank(liquidityProvider);

weth.approve(address(pool), 100e18);

poolToken.approve(address(pool), 100e18);

-->> pool.deposit(100e18, 100e18, 100e18, 0);

​

assertEq(pool.balanceOf(liquidityProvider), 100e18);

assertEq(weth.balanceOf(liquidityProvider), 100e18);

assertEq(poolToken.balanceOf(liquidityProvider), 100e18);

​

assertEq(weth.balanceOf(address(pool)), 100e18);

assertEq(poolToken.balanceOf(address(pool)), 100e18);

}

## Impact Someone can make the deadline `0` or infinite according to their need and will break the protocol.

Tools Used

Manual Review , Foundry

Recommendations

1. Consider removing the deadline inout from the TSWapPool::deposit function

2. If still you are using it have some checks for deadline passing.