First Flight #18: T-Swap

First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Submission Details
Severity: medium
Valid

The `TSwapPool::swapExactOutput` uses Hardcoded block.timestamp as deadline instead of getting it as input

[M-02] The TSwapPool::swapExactOutput uses Hardcoded block.timestamp as deadline instead of getting it as input

Description:
In the sellPoolTokens function, block.timestamp is hardcoded as the deadline for the swapExactOutput transaction. Since block.timestamp can be influenced by validators, it's not recommended to use it directly as a deadline. Instead, the deadline should be obtained as an input parameter to ensure that users have control over the validity period of their transactions.

function sellPoolTokens(
uint256 poolTokenAmount
) external returns (uint256 wethAmount) {
return
swapExactOutput(
i_poolToken,
i_wethToken,
poolTokenAmount,
@> uint64(block.timestamp)
);
}

Impact:
Using block.timestamp directly as the deadline can lead to potential manipulation by miners or validators who have some control over the block timestamp within certain limits. This could result in transactions being included at times that are not optimal for the user, potentially leading to less favorable exchange rates or other unintended consequences.

Proof of Concept:
While a direct proof of concept might be challenging to demonstrate due to the nature of blockchain networks and the difficulty in simulating miner behavior, the theoretical risk exists whenever block timestamps are used in a way that could be influenced by miners. Users might experience transactions being processed later than intended, especially in networks where block times are longer or where miner manipulation is more feasible.

Recommended Mitigation:

To mitigate this issue, the deadline should be added as an input parameter to the sellPoolTokens function. This change allows users to specify their own deadlines, reducing the risk associated with relying on block.timestamp.

function sellPoolTokens(
uint256 poolTokenAmount,
+ uint64 deadline
) external returns (uint256 wethAmount) {
return
swapExactOutput(
i_poolToken,
i_wethToken,
poolTokenAmount,
- uint64(block.timestamp)
+ deadline
);
}
Updates

Appeal created

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Using `uint64(block.timestamp)` as deadline does nothing.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.