Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

The `_swapUnderlyingToAsset` has no deadline parameter

0xsilvermist

Summary

The _swapUnderlyingToAsset has block.timestamp as the deadline parameter which means there is no deadline.

Vulnerability Details

In StrategyArb.sol and StrategyOp.sol the _swapUnderlyingToAsset function performs a swap using a router. The deadline parameter is simply passed in currently as block.timestamp in which the transaction occurs.

IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);

This means that the transaction has no deadline which means that a swap transaction may be included anytime by validators and remain pending in mempool, potentially exposing users to sandwich attacks by attackers or MEV bots.

Impact

No deadline parameter exposing users to sandwich attacks.

Tools Used

Manual Review

Recommendations

Allow the caller of the function to pass a deadline parameter.

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.