Ethereum Credit Guild - nadin's results

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L36 https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L95 https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L121

Vulnerability details

Impact

The current value of POLL_DURATION_BLOCKS is incorrect resulting in checking for poll active in the proposeOffboard() function and poll expired in the supportOffboard() function not working as expected.

Proof of Concept

• The POLL_DURATION_BLOCKS is set to 46523 in LendingTermOffboarding.sol.

36:    uint256 public constant POLL_DURATION_BLOCKS = 46523; // ~7 days @ 13s/block // @audit must be 12s/blocks

• Since moving to Proof-of-Stake (PoS) after the Merge, block times on ethereum are fixed at 12 seconds per block (slots). https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/#:~:text=Whereas%20under%20proof%2Dof%2Dwork,block%20proposer%20in%20every%20slot.
• The time difference can be calulated

>>> 7*24*60*60 / 13    # 7 days / 13 sec block period
46523.076923
>>> 7*24*60*60 / 12    # 7 days / 12 sec block period
50400
>>> 50400 - 46523      # difference in blocks
3877
>>> 3877 * 12 / (60 * 60) # difference in hours
12.92

• By using block time of 13 seconds, POLL_DURATION_BLOCKS expires 12.92 hours earlier than is expected.
• 12.92 hours is a significant amount of time difference so I believe this issue to be Medium severity.
• The votingPeriod() function in GuildVetoGovernor.sol also uses 13s for a block but this function is not used.

    function votingPeriod() public pure override returns (uint256) {
        return 2425847; // ~1 year with 1 block every 13s @audit should be 365*24*60*60 / 12 = 2628000
    }

Tools Used

Manual review

Recommended Mitigation Steps

Change the block period to be 12 seconds

--- 36:    uint256 public constant POLL_DURATION_BLOCKS = 46523
+++ 36:    uint256 public constant POLL_DURATION_BLOCKS = 50400

---    function votingPeriod() public pure override returns (uint256) {
---     return 2425847; // ~1 year with 1 block every 13s
+++    function votingPeriod() public pure override returns (uint256) {
+++     return 2628000; // ~1 year with 1 block every 12s

Assessed type

Timing