veRWA - Strausses's results

Incentivization Primitive for Real World Assets on Canto

General Information

Platform: Code4rena

Start Date: 07/08/2023

Pot Size: $36,500 USDC

Total HM: 11

Participants: 125

Period: 3 days

Judge: alcueca

Total Solo HM: 4

Id: 274

League: ETH

Canto

Findings Distribution

Researcher Performance

Rank: 83/125

Findings: 1

Award: $9.82

QA:
grade-a

🌟 Selected for report: 0

πŸš€ Solo Findings: 0

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/VotingEscrow.sol#L32

Vulnerability details

Impact

Users can unstake their tokens one day earlier than planned.

Proof of Concept

Five years into days will be 1826.25 days. Rounded down, it will be 1826 days. But in the contract, it is hardcoded 1825, which is mathematically incorrect.

Or it can be calculated as 365*5 = 1825 + 1 day(leap year) * 1826

Tools Used

Manual reviewing

set LOCKTIME to 1826 days;

Assessed type

Math

#0 - 141345

2023-08-12T02:40:09Z

QA might be more appropriate.

#1 - c4-sponsor

2023-08-16T14:11:27Z

OpenCoreCH marked the issue as sponsor acknowledged

#2 - c4-sponsor

2023-08-16T14:11:44Z

OpenCoreCH marked the issue as disagree with severity

#3 - c4-judge

2023-08-24T06:33:02Z

alcueca changed the severity to QA (Quality Assurance)

#4 - c4-judge

2023-08-24T06:33:12Z

alcueca marked the issue as grade-a

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax Β© 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter