Alchemix Transmuter

Vulnerability Details

block.timestamp is used as the deadline for swaps in [StrategyOp.sol#L102](https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L102) and [StrategyArb#L87](https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L87) In the PoS model, proposers know well in advance if they will propose one or consecutive blocks ahead of time. In such a scenario, a malicious validator can hold back the transaction and execute it at a more favorable block number.

Impact

This offers no protection as block.timestamp will have the value of whichever block the txn is inserted into, hence the txn can be held indefinitely by malicious validators.

Tools Used

Manual Review

Recommended Mitigation

Consider allowing the function caller to specify the swap deadline input parameter.