Summary

The _swapUnderlyingToAsset function in the StrategyArb.sol contract uses a hardcoded block.timestamp as the deadline for token swaps. While the likelihood of exploitation is low, the use of a static deadline allows validators to manipulate transaction execution timing, potentially causing failures or exploiting Miner Extractable Value (MEV) opportunities in specific scenarios.

Vulnerability Details

• Location: StrategyArb and StrategyOP contracts:
  _swapUnderlyingToAsset function

  function _swapUnderlyingToAsset(

  uint256 _amount,

  uint256 minOut,

  IRamsesRouter.route[] calldata _path

  ) internal {

  // TODO : we swap WETH to ALETH -> need to check that price is better than 1:1

  // uint256 oraclePrice = 1e18 * 101 / 100;

  require(minOut > _amount, "minOut too low");

  uint256 underlyingBalance = underlying.balanceOf(address(this));

  require(underlyingBalance >= _amount, "not enough underlying balance");

  IRamsesRouter(router).swapExactTokensForTokens(

  _amount,

  minOut,

  _path,

  address(this),

  block.timestamp

  );

  }

• Problem:
  Using block.timestamp directly as the swap deadline gives validators, who have control over transaction ordering in block production, the opportunity to exploit the system. Validators can:

  1. Delay Transactions: Intentionally reorder transactions within a block or across blocks to ensure that a swap fails due to an expired deadline.

  2. MEV Exploitation: Use the knowledge of swap parameters to reorder transactions for personal financial gain.

Impact

This vulnerability is categorized as Low because:

• Validators have limited incentives to execute such attacks, especially in decentralized or well-monitored networks.

• Most attacks would require collusion or centralized control to effectively exploit this vulnerability.

• The financial impact is minor unless the transaction size is significant.

• Although in OP and arbitrum the ordering is done by sequencer, its still safer to use an input parameter instead of block.timestamp

Tools Used

Manual Review

Recommendations

1. Allow Configurable Deadlines

   • Replace the hardcoded block.timestamp with a configurable deadline parameter:

     IRamsesRouter(router).swapExactTokensForTokens(

     _amount,

     minOut,

     _path,

     address(this),

     deadline

     );