First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

TSwapPool::deposit does not enforce the deadline parameter, allowing transactions to complete after the intended deadline

chaossr

Summary

The TSwapPool::deposit function fails to enforce the deadline parameter, allowing transactions to complete after the specified deadline.

Vulnerability Details

The deposit function in the TSwapPool contract includes a deadline parameter intended to specify the time by which a transaction should be completed. However, this parameter is currently not enforced within the function's logic. As a result, transactions can be processed even after the specified deadline, potentially leading to liquidity being added at unfavorable market conditions.

Impact

Due to the absence of deadline enforcement in the deposit function, transactions can execute when market conditions are unfavorable for liquidity provision, despite the inclusion of a deadline parameter. This undermines the intended control over transaction timing and liquidity management.

Tools Used

Manual code review

POC

contract Base is Test {
PoolFactory factory;
TSwapPool pool;
ERC20Mock token;
ERC20Mock weth;
​
address Lp = makeAddr("LiquidityProvider");
uint256 LpBalance = 100000000 * 10 **18 ;
function setUp() public {
token = new ERC20Mock();
weth = new ERC20Mock();
factory = new PoolFactory(address(weth));
pool = new TSwapPool(address(token),address(weth), "ERC20Mock" , 'E20M');
token.mint(Lp, LpBalance);
weth.mint(Lp, LpBalance);
}
function test_Deposit() public {
uint256 amount = 10000;
vm.startPrank(Lp);
weth.approve(address(pool), amount);
token.approve(address(pool), amount);
vm.warp(10000000000000000);
// Advance block timestamp to simulate a future deadline
pool.deposit(100e18, 100e18, 100e18, uint64(block.timestamp + 1000));
​
assertEq(pool.balanceOf(liquidityProvider), amount);
assertEq(weth.balanceOf(liquidityProvider), amount);
assertEq(token.balanceOf(liquidityProvider), amount);
​
assertEq(weth.balanceOf(address(pool)), amount);
assertEq(token.balanceOf(address(pool)), amount);
}

Recommendations

you can integrate the existing revertIfDeadlinePassed modifier. Here's how you can modify the deposit function to enforce the deadline check:

function deposit(
uint256 wethToDeposit,
uint256 minimumLiquidityTokensToMint,
uint256 maximumPoolTokensToDeposit,
uint64 deadline
) external
++ revertIfDeadlinePassed(deadline)
returns (uint256 liquidityTokensToMint) {
require(wethToDeposit > 0, "Amount to deposit must be greater than zero");
​
// Additional logic for deposit function
​
return liquidityTokensToMint;
}
​
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`deposit` is missing deadline check causing transactions to complete even after the deadline

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.