The swap mechanism does not have a deadline parameter

[c4-bot-10]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/swappers/UniSwapper.sol#L58

Vulnerability details

Impact

Swap mechanisms should implement a transaction deadline mechanism, due to the following attack vector:

Alice wants to execute a swap, sets slippage to 10% and sends a transaction to the mempool, but with a very low gas fee
Miners/validators see the transaction but the fe is not attractive, so the transaction is stale and pending for a long time
After a week (let's say) the average gas fees drop low enough for the miners/validators to execute the transaction but the price of the assets has changed drastically
Now the value Alice receives is much lower and possibly close to the max slippage she set.
The effects are even worse when there is no slippage as it is the current case in the protocol.

Proof of Concept

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/swappers/UniSwapper.sol#L58C1-L77C6

function swap(
    bytes memory swapPayload
)
    external
    onlyUtb
    returns (address tokenOut, uint256 amountOut)
{
    (SwapParams memory swapParams, address receiver, address refund) = abi
        .decode(swapPayload, (SwapParams, address, address));
    tokenOut = swapParams.tokenOut;
    if (swapParams.path.length == 0) {
        return swapNoPath(swapParams, receiver, refund);
    }
    if (swapParams.direction == SwapDirection.EXACT_IN) {
        amountOut = swapExactIn(swapParams, receiver);
    } else {
        swapExactOut(swapParams, receiver, refund);
        amountOut = swapParams.amountOut;
    }
}

Tools Used

Recommended Mitigation Steps

Add a deadline timestamp parameter to the Swap method and revert the transaction if the expiry has passed.

Assessed type

Uniswap

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #24

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid