Part 2

Summary

The CurveAdapter contract, which facilitates swaps via Curve's exchange router, does not enforce a deadline for swap execution. While the contract inherits a deadline variable from BaseAdapter, this deadline is never used during swaps. This omission exposes users to MEV attacks.

Vulnerability Details

• The CurveAdapter contract defines two key functions for executing swaps:

• These functions are responsible for executing swaps using Curve’s exchange router.

• Within both functions, the contract calls the Curve router to perform the swap.

• The function executes swaps without a deadline parameter, meaning there is no restriction on how long the swap transaction can remain in the mempool before execution.

• The contract inherits a deadline variable from BaseAdapter, but this variable is never used in the swap execution logic.

Impact

• The lack of deadline enforcement exposes users to MEV attacks, where malicious actors can manipulate transaction execution timing in the mempool.

• Attackers can*intentionally delay execution until market conditions worsen, leading to unexpectedly poor swap rates for users.

• This issue makes CurveAdapter inconsistent with Uniswap adapters, which do enforce deadlines, thereby reducing the security guarantees of Curve swaps.

Tools Used

• Manual Code Review

Recommendations

Fix: Enforce Deadline in Swap Execution

Modify the exchange_with_best_rate function call to include a timestamp-based deadline. This ensures that swaps are executed within a safe time window and cannot be delayed indefinitely.