Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

block.timestamp as the deadline parameter

freesultan

Summary

In the StrategyOp.sol contract, specifically within the claimAndSwap function a vulnerability arises from the use of block.timestamp as the deadline parameter in the swapExactTokensForTokens function call to the IVeloRouter.

Vulnerability Details

The swapExactTokensForTokens function from the IVeloRouter interface is invoked with the deadline parameter set to block.timestamp. This means the swap must be executed within the same block in which the transaction is mined. In a PoS environment, validators have the ability to influence the inclusion and ordering of transactions within the blocks they propose.

  • Validators can choose to delay the inclusion of the transaction to a future block where market conditions might be more favorable for executing the swap, potentially leading to better rates than intended.

  • Validators can reorder transactions within a block to prioritize their own transactions or those that benefit them, possibly leading to unfavorable swap outcomes for the strategy.

  • Validators have limited control over the block.timestamp, allowing them to slightly adjust the time to influence the deadline condition. Although the range for manipulation is restricted, it can still be exploited to create advantageous scenarios for the validator.

  • Validators could extract additional value by front-running the swap, especially if they can predict or influence market movements based on the timing of the swap execution.

Impact

Manipulated swap timings can lead to inefficient deployment of funds, negatively impacting the overall performance and returns of the strategy.

Although the risk is low, consistent manipulation could lead to cumulative economic losses over time, diminishing the strategy's effectiveness and investor trust.

Likelihood: low

The potential economic gain for validators exploiting this vulnerability may not justify the effort and risk involved.

Tools Used

Aderyn, Slither, Manual Code Review, AI

Recommendations

Allow Caller-Specified Deadlines:

Modify the claimAndSwap function to accept a deadline parameter from the caller instead of hardcoding it to block.timestamp.

This allows the caller (typically a trusted keeper) to set a more flexible and controlled deadline, mitigating the risk of validators manipulating the execution timing.

function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
IVeloRouter.route[] calldata _path,
uint256 _deadline
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
​
_swapUnderlyingToAsset(_amountClaim, _minOut, _path, _deadline);
​
uint256 balAfter = asset.balanceOf(address(this));
​
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}
​
function _swapUnderlyingToAsset(
uint256 _amount,
uint256 minOut,
IVeloRouter.route[] calldata _path,
uint256 _deadline
) internal {
require(minOut > _amount, "minOut too low");
​
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), _deadline);
}
​

Or implement a Buffer Period:

Instead of relying solely on block.timestamp, introduce a buffer period by setting the deadline to block.timestamp + buffer, where buffer is a short duration (e.g., 300 seconds).

This provides a reasonable window for the transaction to be mined while reducing the risk of excessive delays.

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");
+ uint256 buffer = 300; // 5 minutes
​
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
- IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
+ IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp + buffer);
​
}
​
Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.