# Missing deadline and slippage bounds

Pool, swap, mint or redeem actions that accept no deadline or user-supplied min/max output

_Area: Smart contract access control and control flow. Seen in 5 disclosed reports; latest 2023-09-27. Updated 2026-10-23._

## How it works
A user submits a transaction that prices their action off live on-chain state (reserves, exchange rate, oracle, balance) but supplies no bound on the result and no expiry. The transaction is valid at any price and any time, so whoever orders it can move the price first and let the user's tx execute at the worse rate. The broken assumption is that the state seen at signing is the state at execution; without a user-supplied floor/ceiling and a deadline, nothing enforces that.

## Where it shows up
- Mint/redeem/add-liquidity functions computing output from current reserves with no `minOut`/`maxIn` parameter [E2](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AM-10.md)[E4](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AM-01.md).
- Pool deposit/withdraw/trade entry points with no `deadline` argument [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-11.md).
- Permit/approval flows where the signed amount is derived from live state (exchange rate, balance) rather than a fixed user value [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-11.md).
- Forks of known routers/AMMs where upstream safety modifiers (deadline, min-out) are absent.

## How to review
For every state-priced action, confirm the caller supplies an explicit bound on the amount received or paid, and that the contract reverts when the realized amount violates it. Confirm a deadline is accepted and checked against `block.timestamp`. For permit flows, confirm the signed value is a stable user-chosen quantity, not one recomputed from current exchange rate or balance at execution time [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-11.md). The invariant: no value-changing action executes at a price the caller did not bound, and no signed authorization depends on state that can change between signing and execution.

## Variants seen
- Permit signature over an exchange-rate-derived amount, so rate movement invalidates the signature and reverts the mint (DoS) [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-11.md).
- Equity mint/redeem priced off pool reserve with no min-out, sandwichable for profit [E2](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AM-10.md).
- Pool deposit/withdraw/trade with neither deadline nor slippage bound, allowing stale mempool txs to execute at bad prices [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-11.md).
- Add-liquidity minting LP units from live reserves with no minimum, letting frontrunners shortchange LPs [E4](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AM-01.md).

## Impact and severity
Losses ranged from sandwich profit taken from users [E2](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AM-10.md) to locked lender funds and stale executions [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-11.md), rated medium to high. Severity rises where the price is nonlinear in reserves (larger manipulation payoff) and where the action is a fork that dropped upstream guards, which reviewers treat as a valid high-severity finding [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-11.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-11.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AM-10.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-11.md
- E4: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AM-01.md