# Swapping with deadline as block.timestamp and 0 minimum amount out is vulnerable to MEV Crit/High · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-H02 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description Exchange:swap() sets minAmountOut to 0 and in the plugins the deadline is set to block.timestamp. This means that miners may hold the transaction and do whatever MEV strategy they wish, stealing users who incur massive slippage. ### Recommendation Send block.timestamp as argument to the functions that call swap and forward it. Additionally, Exchange:calculateMinAmountOut() should always be used to protect from MEV, even if not for stablecoins. ### Status Addressed in [#3c1437c](https://github.com/ClipFinance/StrategyRouter-private/commit/3c1437c3dcbe2e9bdee28824b42e799d9cf98301) --- Related findings: - [UniswapV2Swapper uses block.timestamp for deadline [Out of scope]](https://0xsimao.com/findings/fuji-finance-uniswap-timestamp-deadline-scope): Fuji Finance - [Deadline in Ole swap could be sent as a parameter to further prevent MEV](https://0xsimao.com/findings/districtone-deadline-ole-further-mev): DistrictOne - [Deadline parameter in SyrupUserActions::_swapViaBalancer() could be set to minimize MEV](https://0xsimao.com/findings/maple-finance-syrup-balancer-swap-deadline): Maple Syrup - [Attacker can block LayerZero channel due to missing check of minimum gas passed](https://0xsimao.com/findings/tapioca-dao-layer-zero-channel-gas): Tapioca DAO