Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Insufficient deadline protection for swap operations

bladesec

Title

Insufficient deadline protection for swap operations

Summary

The current deadline protection implemented in the claimAndSwap function is effectively ineffective, especially against front-runners, bots, or any entities capable of manipulating transaction ordering to their advantage over honest keepers.

Vulnerability Details

Here's the implementation of claimAndSwap function in StrategyOp contract:

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IVeloRouter.route[] calldata _path ) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
​
>> _swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

And here's how _swapUnderlyingToAsset function interacts with router:

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");
​
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
>> IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}

As demonstrated above, block.timestamp is used as the deadline to safeguard the swap operation. However, relying on the current timestamp undermines the purpose of a deadline, as it can be arbitrarily delayed. Without a properly defined deadline set by the keeper, this approach becomes advantageous to front-runners and MEV bots instead.

Impact

Failing to set an appropriate deadline allows pending transactions to be maliciously executed at a later time, where malicious actors or MEV bots can exploit delayed, underfunded transactions to the detriment of the original submitter.

Tools Used

Manual Review

Recommendations

Consider adding a implicit deadline timestamp by keeper.

Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.