TSwapPool::swapExactOutput
uses Hardcoded block.timestamp as deadline instead of getting it as inputDescription:
In the sellPoolTokens
function, block.timestamp
is hardcoded as the deadline for the swapExactOutput
transaction. Since block.timestamp
can be influenced by validators, it's not recommended to use it directly as a deadline. Instead, the deadline should be obtained as an input parameter to ensure that users have control over the validity period of their transactions.
Impact:
Using block.timestamp
directly as the deadline can lead to potential manipulation by miners or validators who have some control over the block timestamp within certain limits. This could result in transactions being included at times that are not optimal for the user, potentially leading to less favorable exchange rates or other unintended consequences.
Proof of Concept:
While a direct proof of concept might be challenging to demonstrate due to the nature of blockchain networks and the difficulty in simulating miner behavior, the theoretical risk exists whenever block timestamps are used in a way that could be influenced by miners. Users might experience transactions being processed later than intended, especially in networks where block times are longer or where miner manipulation is more feasible.
Recommended Mitigation:
To mitigate this issue, the deadline should be added as an input parameter to the sellPoolTokens
function. This change allows users to specify their own deadlines, reducing the risk associated with relying on block.timestamp
.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.