Vulnerability Details

The deposit function accepts a deadline as an input the parameter which, according to the documentation, "the deadline for the transaction to be completed by". However, this parameter is never actually used. As a consequence, operations that add liquidty to the pool might be executed at unexpected times, in market conditions when the deposit rate is unfavorable.

This also makes this part susceptible to MEV attacks.

Proof of concept: the deadline parameter is unused (this is highlighted by the compiler too).

Impact

Transactions can be sent when market conditions are unfavorable, even when the deadline is set.

Tools Used

Manual review, Foundry.

Recommendations

Perform the following changes to the function: