First Flight #18: T-Swap

First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Submission Details
Severity: medium
Valid

`deadline` in `TSWapPool::deposit` is not used & can be made either 0 or infinite to break the functioning of the protocol

Summary

The deadline input which is meant to tell the time till the functioning has to be completed is not used in TSWapPool::deposit

Proof of Code

PoC
function testDeposit() public {
vm.startPrank(liquidityProvider);
weth.approve(address(pool), 100e18);
poolToken.approve(address(pool), 100e18);
-->> pool.deposit(100e18, 100e18, 100e18, 0);
assertEq(pool.balanceOf(liquidityProvider), 100e18);
assertEq(weth.balanceOf(liquidityProvider), 100e18);
assertEq(poolToken.balanceOf(liquidityProvider), 100e18);
assertEq(weth.balanceOf(address(pool)), 100e18);
assertEq(poolToken.balanceOf(address(pool)), 100e18);
}
## Impact Someone can make the deadline `0` or infinite according to their need and will break the protocol.

Tools Used

Manual Review , Foundry

Recommendations

  1. Consider removing the deadline inout from the TSWapPool::deposit function

  2. If still you are using it have some checks for deadline passing.

Updates

Appeal created

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`deposit` is missing deadline check causing transactions to complete even after the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.