Open code423n4 opened 9 months ago
@geoffchan23 Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label 'sponsor acknowledged' has been removed.
@geoffchan23 Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label 'sponsor disputed' has been removed.
@geoffchan23 Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label 'disagree with severity' has been removed.
@geoffchan23 Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label 'unsatisfactory' has been removed.
@geoffchan23 Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label 'in discussion' has been removed.
@geoffchan23 Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label 'withdrawn by judge' has been removed.
@geoffchan23 Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label '3rd place' has been removed.
@geoffchan23 Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label '3 (High Risk)' has been removed.
@liveactionllama Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label 'unsatisfactory' has been removed.
@liveactionllama Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label '2 (Med Risk)' has been removed.
@liveactionllama Label changes by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity. The label 'duplicate-2' has been removed.
@sockdrawermoney Label changes (additions and removals) by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity.
@sockdrawermoney Label changes (additions and removals) by sponsor team members are restricted to the following labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, resolved, disagree with severity.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@C4-Staff Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@C4-Staff Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@C4-Staff Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@C4-Staff Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed
, sponsor disputed
, sponsor acknowledged
, and disagree with severity
.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed, sponsor disputed, sponsor acknowledged, disagree with severity.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed, sponsor disputed, sponsor acknowledged.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed, sponsor disputed, sponsor acknowledged.
@geoffchan23 Sponsors can only use these labels: sponsor confirmed, sponsor disputed, sponsor acknowledged.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.
Lines of code
307
Vulnerability details
Passing
block.timestamp
as the expiry/deadline of an operation does not mean "require immediate execution" - it means "whatever block this transaction appears in, I'm comfortable with that block's timestamp". Providing this value means that a malicious miner can hold the transaction for as long as they like (think the flashbots mempool for bundling transactions), which may be until they are able to cause the transaction to incur the maximum amount of slippage allowed by the slippage parameter, or until conditions become unfavorable enough that other orders, e.g. liquidations, are triggered. Timestamps should be chosen off-chain, and should be specified by the caller to avoid unnecessary MEV.Assessed type
other