Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`BaseAdapter::setDeadline` function allows the new deadline to be the current `block.timestamp`

bube

Summary

The BaseAdapter::setDeadline function allows the owner to set the deadline parameter that is then used in the swap functions in UniswapV2Adapter and UniswapV3Adapter contracts.

Vulnerability Details

The BaseAdapter::setDeadline function allows the owner to set the deadline parameter. The function checks if the deadline is not in the past, but the function allows the deadline to be the current block.timestamp:

function setDeadline(uint256 _deadline) public onlyOwner {
// revert if the deadline is in the past
@> if (_deadline < block.timestamp) revert Errors.SwapDeadlineInThePast();
​
// set the new deadline
deadline = _deadline;
​
// emit the event
emit LogSetDeadline(_deadline);
}

This deadline is used in several swap functions: UniswapV2Adapter::executeSwapExactInputSingle, UniswapV2Adapter::executeSwapExactInput, UniswapV3Adapter::executeSwapExactInputSingle, UniswapV3Adapter::executeSwapExactInput. This means that the deadlinein these functions can be the current block.timestamp. This enables the pending transactions to be executed at a much later time resulting in a worse price for the user.

Impact

Swap can be executed at later time and the user can face up with the loss when the value of token change.

Tools Used

Manual Review

Recommendations

Don't allow the deadline to be set to the current block.timestamp or allow the users alone to set the deadline paramerter in the swap functions.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.