# Missing transaction expiration check result in reward tokens selling at a lower price

Derby's Swap.swapTokensMulti sets Uniswap exactInput deadline to block.timestamp, disabling expiry so reward-token swaps can be sandwiched at stale prices, reducing depositor yield.

- Payout: Contest reward
- Severity: medium
- Program: Derby
- Credited: Bauer
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/323
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AM-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Uniswap swap in Vault reward-token selling (Swap.sol)
**Root cause:** swapTokensMulti passes block.timestamp as the Uniswap exactInput deadline, so the transaction expiration check never rejects a stale swap; amountOutMinimum computed from an outdated price can be sandwiched.
**Steps:**
1. Vault.rebalance (or claimTokens) calls Swap.swapTokensMulti to sell COMP reward tokens for USDC.
2. swapTokensMulti calls Uniswap exactInput with `deadline = block.timestamp` and amountOutMinimum based on current price.
3. Gas spikes; tx sits in mempool while reward-token price rises.
4. Gas drops, tx mines; MEV bot sandwiches: pushes pool price down so amountOutMinimum still passes, swaps at stale lower price.
5. Protocol/depositors receive less yield than market price.
**How found:** Code review of Swap.swapTokensMulti noticed the Uniswap exactInput deadline argument was set to block.timestamp, which nullifies the expiration protection, then reasoned through a mempool-delay + price-move scenario enabling a sandwich.
**Exploitation:** MEV searcher observes pending rebalance/claimTokens swap, front-runs to depress reward-token pool price, lets the stale-deadline swap execute at the manipulated lower price satisfying amountOutMinimum, then back-runs to profit; protocol sells reward tokens below market.
**Insight:** When auditing Uniswap integrations, grep for `deadline` arguments: any `block.timestamp` (or far-future) value disables slippage/expiry protection and turns amountOutMinimum into the only defense, which a sandwich can still satisfy by manipulating pool price.