veRWA - InAllHonesty's results

Incentivization Primitive for Real World Assets on Canto

General Information

Platform: Code4rena

Start Date: 07/08/2023

Pot Size: $36,500 USDC

Total HM: 11

Participants: 125

Period: 3 days

Judge: alcueca

Total Solo HM: 4

Id: 274

League: ETH

Canto

Findings Distribution

Researcher Performance

Rank: 96/125

Findings: 1

Award: $9.82

QA:
grade-a

🌟 Selected for report: 0

🚀 Solo Findings: 0

Summary

The number 255 is not an acurate representation of how many weeks are in 1825 days / 5 years period.

Vulnerability Details

Within the _checkpoint (a) and _supplyAt (b) functions in VotingEscrow.sol there is a for loop that:

(a) Go over weeks to fill history and calculate what the current point is. _checkpoint (b) Iterates through all weeks between _point & _t to account for slope changes. _supplyAt

The number 255 has been chosen in order to represent all the possible weeks. But given that the LOCKTIME is 1825 days (5 years) the better number to use here is 260 (1825/7 floored). In extreme edge cases not using 260 can generate unexpected outcomes like missing out some weeks data.

Recommendations

Use 260 to match the correct amount of weeks in a 5 years period.

#0 - c4-judge

2023-08-22T14:17:08Z

alcueca marked the issue as grade-a

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter