Alchemix Transmuter

Summary

The use of block.timestamp as a deadline in AMM interactions poses significant risks, as it does not effectively limit the transaction's validity period. This approach allows transactions to remain valid indefinitely until they are included in a block, leaving them vulnerable to delayed execution and unfavorable market conditions. Without the ability for users to set their own expiration deadlines, there is increased exposure to market volatility and potential financial losses, as users lack control over the timing of transaction execution.

Vulnerability Details

The swapExactTokensForTokens function use of block.timestamp as the deadline.

The function passes block.timestamp as the deadline parameter, this implementation allows transactions to remain valid indefinitely until they are included in a block, exposing users to risks associated with delayed execution.

Impact

1. Miners can adjust block.timestamp within a permissible range, potentially executing the transaction at an unintended time.

2. Without a strict deadline, the transaction may execute during unfavorable market conditions, leading to higher slippage.

3. The lack of a proper deadline increases the risk of front-running and sandwich attacks, as attackers have more time to observe and react to the transaction.

Tools Used

Manual Review

Recommendation

Allow users to specify their own expiration deadlines for transactions, providing them with control over the execution timeframe.