Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Static deadline causes issues after block.timestamp exceeds it

kwakudr

Summary\

This static state deadline variable causes all swaps to rely on a fixed timestamp, risking transaction failure once outdated.

Vulnerability Details\

function executeSwapExactInput(SwapExactInputPayload calldata swapPayload) external returns (uint256 amountOut) {
// transfer the tokenIn from the send to this contract
IERC20(swapPayload.tokenIn).transferFrom(msg.sender, address(this), swapPayload.amountIn);
​
​
// aprove the tokenIn to the swap router
address uniswapV2SwapStrategyRouterCache = uniswapV2SwapStrategyRouter;
IERC20(swapPayload.tokenIn).approve(uniswapV2SwapStrategyRouterCache, swapPayload.amountIn);
​
​
// get the expected output amount
uint256 expectedAmountOut = getExpectedOutput(swapPayload.tokenIn, swapPayload.tokenOut, swapPayload.amountIn);
​
​
// Calculate the minimum acceptable output based on the slippage tolerance
uint256 amountOutMinimum = calculateAmountOutMin(expectedAmountOut);
​
​
// decode path as it is Uniswap V3 specific
(address[] memory tokens,) = swapPayload.path.decodePath();
​
​
// execute trade
uint256[] memory amountsOut = IUniswapV2Router02(uniswapV2SwapStrategyRouterCache).swapExactTokensForTokens({
amountIn: swapPayload.amountIn,
amountOutMin: amountOutMinimum,
path: tokens,
to: swapPayload.recipient,
deadline: deadline
});
​
​
// return the amount out of the last trade
return amountsOut[tokens.length - 1];
}

The deadline is stored as a state variable and not recalculated per swap.

If not updated via setDeadline, all subsequent swaps unconditionally use a past timestamp, reverting even for valid transactions.

Swap deadlines must always be in the future relative to execution time (block.timestamp).

A static deadline breaks this invariant once block.timestamp exceeds it, rendering all swaps invalid.

Impact

A static deadline breaks this invariant once block.timestamp exceeds it, rendering all swaps invalid.

Tools Used

Manual Review

Recommendations

Replace static deadline with dynamic calculation per swap. Remove the deadline state variable and associated setDeadline function to enforce real-time validity for all swap

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.