Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect set deadline logic in swap adapters

pontifex

Summary

The BaseAdapter.setDeadline function sets the new deadline variable which is used in the swap parameters. The problem of the implementation is that the deadline variable is an absolute value and should be set before each swap to prevent swapping with stale parameters such as amountOutMin.

Vulnerability Details

The new _deadline should exceed the block.timestamp.

function setDeadline(uint256 _deadline) public onlyOwner {
// revert if the deadline is in the past
if (_deadline < block.timestamp) revert Errors.SwapDeadlineInThePast();
​
// set the new deadline
deadline = _deadline;
​
// emit the event
emit LogSetDeadline(_deadline);
}

The deadline variable is used as is in the swap parameters.

uint256[] memory amountsOut = IUniswapV2Router02(uniswapV2SwapStrategyRouterCache).swapExactTokensForTokens({
amountIn: swapPayload.amountIn,
amountOutMin: amountOutMinimum,
path: path,
to: swapPayload.recipient,
deadline: deadline
});

When the deadline variable will be set for the first time it will be necessary to continuously update. It is important because the protocol uses off chain price as a base for the amountOutMin parameter calculation and the late deadline can cause swapping with worse prices.

Impact

Unintended behavior, unexpected slippage.

Tools used

Manual Review

Recommendations

Consider implementing relative deadline parameter:

swapExactTokensForTokens({
amountIn: swapPayload.amountIn,
amountOutMin: amountOutMinimum,
path: path,
to: swapPayload.recipient,
>> deadline: deadline + block.timestamp
})
function setDeadline(uint256 _deadline) public onlyOwner {
- // revert if the deadline is in the past
- if (_deadline < block.timestamp) revert Errors.SwapDeadlineInThePast();
​
// set the new deadline
deadline = _deadline;
​
// emit the event
emit LogSetDeadline(_deadline);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.