c4-bot-9 commented 8 months ago

Lines of code

https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/pallets/stableswap/src/lib.rs#L551-L842

Vulnerability details

Impact

Missing deadline check

Proof of Concept

Few functions don't have deadline parameter. This parameter can provide the user an option to limit the execution of their pending transaction. Without a deadline parameter, users can execute their transactions at unexpected times when market conditions are unfavorable.

Function like do_add_liquidity(), do_add_liquidity_shares(), remove_liquidity_one_asset, withdraw_asset_amount(), sell() or buy() need to have deadline check. However, this is not a big problem in this case because the functions have slippage protection. Even though the users will get at least as much as they set, they may still be missing out on positive slippage if the exchange rate becomes favorable when the transaction is included in a block.

Similar report in code4rena and the explanation why this is medium even though it has slippage protection: https://github.com/code-423n4/2023-08-pooltogether-findings/issues/126#issuecomment-1678355315

Tools Used

Visual Studio Code

Recommended Mitigation Steps

Introduce a deadline parameter in these functions.

Assessed type

MEV

c4-pre-sort commented 8 months ago

0xRobocop marked the issue as duplicate of #139

c4-judge commented 7 months ago

OpenCoreCH changed the severity to QA (Quality Assurance)