Deadline in IV3SwapRouter::ExactOutputParams is not set, any market swings could keep this transaction pending

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/07ef78215e3d246d47a410651906287c6acec3ef/src/swappers/UniSwapper.sol#L143-L169

Vulnerability details

Impact

In ExactOutputParams of Uniswap, the deadline parameter tells uniswap the deadline before which the swap should get executed. Incase, the swap could not be executed, the transaction should be retired.

Not passing deadline leaves the swap order pending and will be execute when market meets the parameter conditions again.

Proof of Concept

https://github.com/code-423n4/2024-01-decent/blob/07ef78215e3d246d47a410651906287c6acec3ef/src/swappers/UniSwapper.sol#L143-L169

Since the deadline is no set, if there was a market swing leading to change in circumstances not matching the parameter conditions, the swap order will live as pending order to be executed.

hence, there is a potential that the order will be executed at some other time when it was assumed as cancelled.

This is not recommended.

 IV3SwapRouter.ExactOutputParams memory params = IV3SwapRouter
            .ExactOutputParams({
                path: swapParams.path,
                recipient: address(this),
                //deadline: block.timestamp,
                amountOut: swapParams.amountOut,
                amountInMaximum: swapParams.amountIn
            });

Tools Used

Manual review

Recommended Mitigation Steps

Set the deadline to some time line on top of block.timestamp, say 10 minutes or one hour.

Assessed type

Uniswap

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #24

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid