Alchemix Transmuter

Summary

Block timestamps are usually set based on the sequencer's clock. In some cases in can be manuplated to make a bad swaps.

Vulnerability Details

As it says in the Arbitrum official documentation the sequencer can slightly adjust the timestamp of the block to account for the delays and prevent any potential reorganisations of the chain:

https://docs.arbitrum.io/build-decentralized-apps/arbitrum-vs-ethereum/block-numbers-and-time#timestamp-boundaries-of-the-sequencer

The swaps in StrategyArb contract has a block.timestamp argument in the swap function:

So in some cases a sequecer can manipulate a timestamp to frontrun the tx and implement a swap to get profit.

Or, as it sas here:

https://docs.arbitrum.io/for-devs/troubleshooting-building#how-do-blocknumber-and-blocktimestamp-work-on-arbitrum

Solidity calls to block.timestamp on Arbitrum are not linked to the timestamp of the L1 block. It is updated every L2 block based on the sequencer's clock.

In this case the tx may be reversed as the timestamp is passed.

Impact

Swaps can be manipulated on Arbitrum chain.

Tools Used

Manual review.

Recommendations

Consider providing additional time for swaps to be executed.