UniSwapper.sol#swapExactOut/swapExactIn - omitted deadline parameters

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/07ef78215e3d246d47a410651906287c6acec3ef/src/swappers/UniSwapper.sol#L123-L141
https://github.com/code-423n4/2024-01-decent/blob/07ef78215e3d246d47a410651906287c6acec3ef/src/swappers/UniSwapper.sol#L143-L169

Vulnerability details

Impact

The UniSwapper contract contains the logic to execute either a cross-chain or same-chain swaps using UniswapV3's exact params functions, but an important check is omitted.

Proof of Concept

As it can be seen in both the exact params' construction, the deadline parameter for the swaps is omitted, disabling it entirely, allowing the transaction to be a greater target to MEV.
One could argue that the slippage checks present in both functions is sufficient enough but that's not the case since the user could potentially be missing out on refunded value he could have saved or more out amount that he got due to the missing slippage, had he used a deadline parameter. Another impact of MEV is the transaction being forced into reverting swaps using the slippage against itself.

Tools Used

Manual Review

Recommended Mitigation Steps

Let the user specify a deadline parameter as part of his swap payload or instructions

Assessed type

Uniswap

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as primary issue

[raymondfam]

The protocol is aware of that and makes a preference to comment it out for various reasons e.g. inconsequential on layerzero etc with slippage already in place.

[alex-ppg]

The absence of the deadline parameter is not what this submission and its duplicates detail.

The submission argues that arbitrage attacks and delayed execution can be taken advantage of to acquire a profit, however, the transactions will never execute as #117 correctly states.

Based on the above, I will invalidate this and all relevant submissions due to being incorrect as no transaction will properly execute.

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid