No deadline check in UlyssesRouter.sol when swapping tokens

[code423n4]

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/main/src/ulysses-amm/UlyssesRouter.sol#L73

Vulnerability details

Impact

Usually DEXs add a deadline parameter to their swap functions to protect users whose transaction got stuck on the blockchain and is completed when the price is below/above that what they expected at the time the swap was submitted.

Proof of Concept

Let's say Alice wants to swap 1000 Token0 for 500 Token1, she sends the transaction via our router, but pays a small amount of gas, so her transaction was placed last, by the time it is completed price for Token1 has risen making it 1000 Tokens0 for 400 Token1, which results in the loss of tokens on unfavorable trade.

Tools Used

Manual review

Recommended Mitigation Steps

Add a deadline check

function swap(uint256 amount, uint256 minOutput, Route[] calldata routes, uint256 deadline) external returns (uint256) {
        require(deadline >= block.timestamp, 'Expired')

Assessed type

Timing

[c4-judge]

trust1995 marked the issue as duplicate of #171

[c4-judge]

trust1995 marked the issue as satisfactory