Execution of swaps in the before bridging operation and in the same-chain txs lacks deadline

[c4-bot-1]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/main/src/swappers/UniSwapper.sol#L58-L77
https://github.com/code-423n4/2024-01-decent/blob/main/src/swappers/UniSwapper.sol#L123-L169

Vulnerability details

Proof of Concept

In UniSwapper.sol, part of the Decent protocol, swaps are executed as part of the token exchange process. This contract interacts with Uniswap or similar decentralized exchanges (DEXs) to perform token swaps. However, the execution of these swaps, particularly before bridging operations and in same-chain transactions, does not include a deadline parameter. In typical DEX interactions, a deadline is used to specify the time by which a swap must be completed, providing a safeguard against unfavorable changes in market conditions or potential manipulation.

In the UniSwapper.sol contract, functions that interact with DEXs for swapping tokens (e.g., swapExactIn, swapExactOut) do not include a deadline parameter. This can be confirmed by reviewing the contract code and noting the absence of a time-bound condition for swap execution.

    function swap(
        bytes memory swapPayload
    )
        external
        onlyUtb
        returns (address tokenOut, uint256 amountOut)
    {
        (SwapParams memory swapParams, address receiver, address refund) = abi
            .decode(swapPayload, (SwapParams, address, address));
        tokenOut = swapParams.tokenOut;
        if (swapParams.path.length == 0) {
            return swapNoPath(swapParams, receiver, refund);
        }
        if (swapParams.direction == SwapDirection.EXACT_IN) {
            amountOut = swapExactIn(swapParams, receiver);
        } else {
            swapExactOut(swapParams, receiver, refund);
            amountOut = swapParams.amountOut;
        }
    }

    function swapExactIn(
        SwapParams memory swapParams, // SwapParams is a struct
        address receiver
    ) public payable routerIsSet returns (uint256 amountOut) {
        swapParams = _receiveAndWrapIfNeeded(swapParams);

			  //@audit missing deadline parameter
        IV3SwapRouter.ExactInputParams memory params = IV3SwapRouter
            .ExactInputParams({
                path: swapParams.path,
                recipient: address(this),
                amountIn: swapParams.amountIn,
                amountOutMinimum: swapParams.amountOut
            });

        IERC20(swapParams.tokenIn).approve(uniswap_router, swapParams.amountIn);
        amountOut = IV3SwapRouter(uniswap_router).exactInput(params);

        _sendToRecipient(receiver, swapParams.tokenOut, amountOut);
    }

    function swapExactOut(
        SwapParams memory swapParams,
        address receiver,
        address refundAddress
    ) public payable routerIsSet returns (uint256 amountIn) {
        swapParams = _receiveAndWrapIfNeeded(swapParams);
				//@audit missing deadline parameter
        IV3SwapRouter.ExactOutputParams memory params = IV3SwapRouter
            .ExactOutputParams({
                path: swapParams.path,
                recipient: address(this),
                //deadline: block.timestamp,
                amountOut: swapParams.amountOut,
                amountInMaximum: swapParams.amountIn
            });

        IERC20(swapParams.tokenIn).approve(uniswap_router, swapParams.amountIn);
        amountIn = IV3SwapRouter(uniswap_router).exactOutput(params);

        // refund sender
        _refundUser(
            refundAddress,
            swapParams.tokenIn,
            params.amountInMaximum - amountIn
        );

        _sendToRecipient(receiver, swapParams.tokenOut, swapParams.amountOut);
    }

Impact

The absence of a deadline in swap transactions can lead to several issues:

1. Front-Running Vulnerability: Without a deadline, transactions are more susceptible to front-running, where malicious actors can observe a pending swap transaction and execute their own transactions first to affect the market price.
2. Market Risk: Users are exposed to market risk for a longer duration, as the swap can be executed at any time, potentially leading to execution at less favorable prices.
3. User Experience: Users have no control over the maximum duration for which their transaction can remain pending, which can lead to uncertainty and potential financial losses.

The issue presents a clear risk in terms of potential financial losses and exploitation through market manipulation. However, it does not directly lead to immediate loss of funds or critical contract failures. The severity could be higher in scenarios where the market is highly volatile, or the protocol is heavily utilized, increasing the likelihood of exploitation.

Tools Used

Manual code review

Recommendations

To mitigate the risks associated with the lack of a deadline in swap operations, consider the following recommendations:

1. Implement Deadline Parameter: Modify the swap functions in UniSwapper.sol to include a deadline parameter. This parameter should be passed along to the DEX interface to ensure that swaps are only executed within the specified time frame.
2. User-Defined Deadlines: Allow users to specify the deadline when initiating a swap. This gives users control over the timing of their transactions and reduces their exposure to market risks.

Assessed type

Other

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #24

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid