First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`TSwapPool::deposit` has no `deadline` check, transaction will not revert even if deadline specified by user has passed

4lifemen

Summary

The deposit function accepts a deadline parameter but does not utilize it, and lacks logic to check whether the deadline has passed. As a result, liquidity providers are susceptible to unfavorable market conditions and potential front-running attacks.

Vulnerability Details

The deposit function accepts a deadline parameter intended to ensure that transactions are executed within a specific time frame, thereby protecting users from unfavorable market conditions and front-running attacks. However, the function does not utilize this parameter or implement any logic to check whether the deadline has passed.

function deposit(
...
uint64 deadline
)
...
returns (uint256 liquidityTokensToMint)
{

Proof of Concept
The deadline parameter is not used and revert if deadline has passed logic is not implemented.

Impact

Transaction could be sent when market conditions are unfavorable to user.

Tools Used

  • Manual review

Recommendations

Consider making the following changes

function deposit(
uint256 wethToDeposit,
uint256 minimumLiquidityTokensToMint,
uint256 maximumPoolTokensToDeposit,
uint64 deadline
)
external
revertIfZero(wethToDeposit)
+ revertIfDeadlinePassed(deadline)
returns (uint256 liquidityTokensToMint)
{
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`deposit` is missing deadline check causing transactions to complete even after the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.