Maia DAO Ecosystem - btk's results

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/main/src/governance/GovernorBravoDelegateMaia.sol#L18-L27

Vulnerability details

Impact

Note: The sponsor message on which networks project will be deployed.

Vote period/delay will not work correctly on L2s due to the use of block.number, which may not give holders enough time to delegate or cast before the voting delay or period ends.

Proof of Concept

    uint256 public constant MIN_VOTING_PERIOD = 80640; // About 2 weeks

    /// @notice The max setable voting period
    uint256 public constant MAX_VOTING_PERIOD = 161280; // About 4 weeks

    /// @notice The min setable voting delay
    uint256 public constant MIN_VOTING_DELAY = 40320; // About 1 weeks

    /// @notice The max setable voting delay
    uint256 public constant MAX_VOTING_DELAY = 80640; // About 2 weeks

Each of these values represent a specific period in ethereum blocks (.i.e 12s), but all of this values will not give the holders enough time when deploying on L2s due to .

Here is a simple comparison of block times across different networks:

Tools Used

Manual Review

Recommended Mitigation Steps

We recommend using block.timestamp instead of block.number.

Assessed type

Timing