Alchemix Transmuter

Summary

The expiration deadline specifies a time limit in which the transaction can be executed. Using `block.timestamp` as an expiration deadline allows the transaction to be executed at a later time, resulting in a worse price and will not take full "advantage of any depeg of alETH vs WETH.".

As explained here:
https://defihacklabs.substack.com/p/solidity-security-lesson-6-defi-slippage?utm_source=profile&utm_medium=reader2#§no-expiration-deadline

Vulnerability Details

block.timestamp is used as a deadline which allows the transactions to be executed at the wrong.

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L87

Impact

Using block.timestamp as a deadline allows block.validators to include the transaction at different time

Tools Used

manual review

Recommendations

Allow to specify a deadline parameter, implement checks for `deadline > block.timestamp`.