A swap passes block.timestamp as its own deadline, which disables the deadline check entirely: whenever a validator finally includes the transaction the check is trivially satisfied. A pending swap can be held and released at the most profitable (for the attacker) moment.
// tx sits in the mempool for hours; validator releases it when price is worst. // require(block.timestamp <= block.timestamp) is always true -> no protection.
// deadline must come from the caller, not the block being mined
router.swapExactTokensForTokens(amountIn, minOut, path, to, userDeadline);
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0105 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.