Tapioca DAO - tsvetanovv's results

Lines of code

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/markets/singularity/SGLLeverage.sol#L117-L122 https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/markets/singularity/SGLLeverage.sol#L175-L181 https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/usd0/modules/USDOLeverageModule.sol#L190-L214 https://github.com/Tapioca-DAO/tapioca-periph-audit/blob/main/contracts/Swapper/CurveSwapper.sol#L94-L142

Vulnerability details

Impact

Missing deadline checks allow pending transactions to be maliciously executed in the future. Without deadline parameters, as a consequence, users can have their operations executed at unexpected times, when the market conditions are unfavorable.

Proof of Concept

The problem occurs in these functions: https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/markets/singularity/SGLLeverage.sol#L117-L122

SGLLeverage.sol
97: function sellCollateral(
	.....
	(amountOut, shareOut) = swapper.swap(   
            swapData,
            minAmountOut,
            from,
            dexData
        );
147: function buyCollateral(
	.....
	(amountOut, collateralShare) = swapper.swap(    
            swapData,
            minAmountOut,
            from,
            dexData

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/usd0/modules/USDOLeverageModule.sol#L190-L214

USDOLeverageModule.sol
190: function leverageUpInternal(
	.....
	(uint256 amountOut, ) = ISwapper(externalData.swapper).swap( 
            _swapperData,
            swapData.amountOutMin,
            address(this),
            swapData.data
        );

https://github.com/Tapioca-DAO/tapioca-periph-audit/blob/main/contracts/Swapper/CurveSwapper.sol#L94-L142

CurveSwapper.sol
94: function swap(   
        SwapData calldata swapData,
        uint256 amountOutMin,
        address to,
        bytes memory data
     ......

The deadline check ensures that the transaction can be executed on time and the expired transaction revert.

Tools Used

Visual Studio Code

Recommended Mitigation Steps

Introduce a deadline parameter in these functions.

Assessed type

Timing