Arcade.xyz - Matin's results

Lines of code

https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/external/council/CoreVoting.sol#L13 https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/external/council/CoreVoting.sol#L15

Vulnerability details

Impact

The block time related parameters of a proposal become less than what was expected

Proof of Concept

ArcadeGSCCoreVoting contract inherits from the coreVoting contract and initializes in its constructor. As per documents, the contract coreVoting is out of scope, however as the ArcadeGSCCoreVoting does nothing but initializing that contract, we can conclude that it should be analyzed too. If we look deeper at the Council's coreVoting contract we can see it is written and been audited before the Ethereum merge phase. As stated in the line 13, the calculations with respect to block time is considered with an average block time of 13.3 seconds. Before the merge, the block time had some fluctuations but the mean block time was 13.3 seconds. After the merge, this amount dropped considerably and been set 12 seconds per block.. Considering this fact we can see the actual DAY_IN_BLOCKS becomes 7200. We can derive the preceding calculations:

δ : DAY_IN_BLOCKS difference parameter
β : lockDuration difference parameter
α : extraVoteTime difference parameter

-----------------------------------------

δ = 7200 - 6496 = 704
β = δ * 3 = 2112
α = δ * 5 = 3520

As we can see from the calculations above, the difference in lockDuration and extraVoteTime parameters become more sensible. lockDuration and extraVoteTime difference parameters reach nearly 1/3 and 1/2 of the actual DAY_IN_BLOCKS respectively. This means that the actual DAY_IN_BLOCKS time affects the proposal times by truncating the desired time interval of the aforementioned parameters. Thus, a proposal's lockDuration and extraVoteTime become ~8 and ~12 hours-in-block less than the expected time respectively.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider modifying the DAY_IN_BLOCK parameter and reset it with respect to the POS Ethereum block time

Assessed type

Math