Fujicracy / fuji-v2

Cross-chain money market aggregator
https://fuji-v2-frontend.vercel.app
15 stars 10 forks source link

router: missing deadline check in swap function #351

Open cvetanovv opened 1 year ago

cvetanovv commented 1 year ago

Vulnerability Detail

Every swap function must have a deadline. Missing deadline checks allow pending transactions to be maliciously executed in the future. You need to add a deadline parameter to all functions which potentially perform a swap on the user's behalf.

Impact

Without deadline parameter, as a consequence, users can have their operations executed at unexpected times, when the market conditions are unfavorable.

Code Snippet

https://github.com/Fujicracy/fuji-v2/blob/v0.0.1/packages/protocol/src/abstracts/BaseRouter.sol#L126-L279

Recommendation

Introduce a deadline parameter in every swap function.