Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

setDeadline in BaseAdapter uses a statically integrated deadline an can therefor hold swaps in the mempool for a long time

0xtimefliez

Description

BaseAdapter::setDeadline sets a global deadline responsible for every trade in the protocol going through the Dex Adapters.

Vulnerable Code

BaseAdapter::setDeadline

function setDeadline(uint256 _deadline) public onlyOwner {
if (_deadline < block.timestamp) revert Errors.SwapDeadlineInThePast();
deadline = _deadline;
emit LogSetDeadline(_deadline);
}

Impact

A globally, unfrequently set, fixed deadline for trades allows miners/validators to hold back on that transaction until they reach a favorable point in time to execute this transactions. Issues with improperly set deadlines are very well documented. While it might not necessarily be a big issue on a Sequencer Chain like Arbitrum, Monad on the other hand will have a mempool, so it should be taken into consideration.

As the primary chain to be deployed to is Arbitrum and Monad would follow at an unspecified time in the future, I rate this issue as Medium.

Recommended Mitigation

Instead of setting a global deadline consider setting a global executionTime and calculate the deadline within the functions with executionTime instead of a general deadline

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.