Submission Details
Severity:
Critical constant error YIELD_DELAY_HOURS
Summary
A constant for 1 hours has the 'hours' committed making it 1 instead
Vulnerability Details
uint256 internal constant YIELD_DELAY_HOURS = 1; // omits hours
Impact
Constant is used in LibShortRecord.sol
bool isNotRecentlyModified =
LibOrders.getOffsetTimeHours() - updatedAt > Constants.YIELD_DELAY_HOURS;
if (isNotRecentlyModified) {
s.vaultUser[vault][shorter].ethEscrowed += yield;
} else {
s.vaultUser[vault][address(this)].ethEscrowed += yield;
}
The above determines if not recently modified in hours but Constants.YIELD_DELAY_HOURS = 1 the smallest unit time so LibOrders.getOffsetTimeHours() - updatedAt will likely incorrectly always be greater than 1 leading to isNotRecentlyModifed passing more than expected, leading to part below yield always being updated
s.vaultUser[vault][shorter].ethEscrowed += yield;
Therefore it results in yield being updated more times than is correct
Tools Used
Manual Analysis
Recommendations
Change to hours
uint256 internal constant YIELD_DELAY_HOURS = 1 hours; // add ommitted 'hours'
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.