Nouns DAO contest - shenwilly's results

A DAO-driven NFT project on Ethereum.

General Information

Platform: Code4rena

Start Date: 22/08/2022

Pot Size: $50,000 USDC

Total HM: 4

Participants: 160

Period: 5 days

Judge: gzeon

Total Solo HM: 2

Id: 155

League: ETH

Nouns DAO

Findings Distribution

Researcher Performance

Rank: 98/160

Findings: 1

Award: $35.44

🌟 Selected for report: 0

🚀 Solo Findings: 0

[L-01] Inaccurate block time after The Merge

NounsDAOLogicV2.sol#L68 NounsDAOLogicV2.sol#L71 NounsDAOLogicV2.sol#L77 NounsDAOLogicV1.sol#L76 NounsDAOLogicV1.sol#L79 NounsDAOLogicV1.sol#L85

/// @notice The minimum setable voting period uint256 public constant MIN_VOTING_PERIOD = 5_760; // About 24 hours /// @notice The max setable voting period uint256 public constant MAX_VOTING_PERIOD = 80_640; // About 2 weeks /// @notice The max setable voting delay uint256 public constant MAX_VOTING_DELAY = 40_320; // About 1 week

MIN_VOTING_PERIOD, MAX_VOTING_PERIOD, and MAX_VOTING_DELAY assume that block time would be around 15 seconds. However, once Ethereum transitioned to Proof of Stake in less than a month, blocks will come in exactly 12 seconds. This will cause a 20% deviation between the expected and the actual timing.

For example, MIN_VOTING_PERIOD which should be 24 hours (5760 * 15 / 3600) will become 19 hours (5760 * 12 / 3600). This discrepancy might surprise users that expect the minimum voting period to last for a day, causing them to miss voting on proposals.

Consider adjusting the value of these constants to match the new block time.

References:

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter