Open c4-bot-1 opened 5 months ago
0xEVom marked the issue as primary issue
0xEVom marked the issue as sufficient quality report
kalinbas (sponsor) acknowledged
ERC4626 does not support this parameter, so we can't add it to the main deposit and withdraw functions.
Related https://github.com/code-423n4/2024-02-uniswap-foundation-findings/issues/331
Could you give more info please? I do not have access to the linked repo. @0xEVom
Also deposit and withdraw do not have any slippage problem (like trading does) so it is not needed here. This should be a QA severity.
kalinbas marked the issue as disagree with severity
@kalinbas yes sorry, that was more for future and internal reference. Severity of a similar issue is currently being debated.
I guess this is very similar to https://github.com/code-423n4/2024-03-revert-lend-findings/issues/281#issuecomment-2007420728
Note that trading is also mentioned in this finding (see https://github.com/code-423n4/2024-03-revert-lend-findings/issues/129)
Ok i agree with deadline for trading. Will add it there
kalinbas (sponsor) confirmed
Based on this well-known case that has been discussed by several senior judges, QA is appropriate. https://github.com/code-423n4/2024-02-uniswap-foundation-findings/issues/331
jhsagd76 changed the severity to QA (Quality Assurance)
jhsagd76 marked the issue as grade-a
Lines of code
https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L877-L917 https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L920-L952
Vulnerability details
The protocol missing the DEADLINE check at all in logic.
This is actually how uniswap implemented the deadline https://github.com/Uniswap/v2-periphery/blob/0335e8f7e1bd1e8d8329fd300aea2ef2f36dd19f/contracts/UniswapV2Router02.sol#L32-L76
The point is the deadline check
The deadline check ensure that the transaction can be executed on time and the expired transaction revert.
Impact
The transaction can be pending in mempool for a long and the trading activity is very time sensitive. Without deadline check, the trade transaction can be executed in a long time after the user submit the transaction, at that time, the trade can be done in a sub-optimal price, which harms user's position.
The deadline check ensure that the transaction can be executed on time and the expired transaction revert.
Tools Used
Manual review
Recommended Mitigation Steps
Consider adding deadline check like in the functions like withdraw and deposit.
Assessed type
Invalid Validation