IV3SwapRouter of the swap-router-contracts lib lacks deadline checks which can cause timing execution issues

[c4-bot-1]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/swappers/UniSwapper.sol#L129-L135
https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/swappers/UniSwapper.sol#L149-L156
https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/swappers/SwapParams.sol#L9-L20

Vulnerability details

Impact

The protocol uses the IV3SwapRouter of the swap-router-contracts lib rather than using the swap functions defined in the SwapRouter contarct of the v3-periphery lib of UniswapV3 protocol. The key difference between both, is that UniswapV3 uses the modifier checkDeadline before calling any swap functions CheckDeadline. Plus, the UniswapV3 has a deadline parameter defined for the struct ExactInputSingleParams unlike the swap-router-contracts.

However, the absence of the checkDeadline modifier and the deadline parameter, can lead to issues related to the timing of swap executions. In Automated Market Maker (AMM) systems, front-running and transaction timing are critical. Without deadline checks, transactions could be manipulated by validators or miners to occur at times that are unfavorable to users or the protocol, potentially causing maximum slippage or other forms of transaction manipulation.

Proof of Concept

In the UniSwapper contract, the library used lacks the checkDeadline modifier present in UniswapV3's SwapRouter contract. This modifier is crucial for enforcing a deadline on swap transactions:

modifier checkDeadline(uint256 deadline) {
    require(_blockTimestamp() <= deadline, 'Transaction too old');
    _;
}

Without this check, swap transactions lack a crucial safeguard against timing manipulation.

Tools Used

Manual review

Recommended Mitigation Steps

Use the functions defined in the SwapRouter contract of the v3-periphery lib of UniswapV3 protocol instead. With this library used, the SwapParams struct needs to be updated to account for the deadline parameter which should also be chosen by the user or detemined off-chain.

Assessed type

Uniswap

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #24

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid