Dria

Swan
NFTHardhat
21,000 USDC
View results
Submission Details
Severity: high
Invalid

Incorrect Round Offset in `UserAgent::getRoundPhase()` Calculation

Summary

The UserAgent::getRoundPhase() function adds an extra offset round when calculating the round value, which can lead to an inaccurate round count. It results in an unintended round increment that may prevent orders from being correctly matched and purchased.

Vulnerability Details

The round calculation in UserAgent::getRoundPhase() is designed to accumulate rounds from each intermediate phase, including an additional offset round:

358: // accumulate rounds from each intermediate phase, along with a single offset round
359: round += innerRound + 1;
...
369: // accumulate the last round as well, along with a single offset round
370: round += lastRound + 1;

The round calculated by the _computePhase() with formula:

314: uint256 round = elapsedTime / cycleTime;

If elapsedTime % cycleTime equals zero, this indicates that a cycle has just ended and a new cycle is beginning. In such cases, the calculated round already matches the actual number of elapsed cycles. Adding an extra offset round results in a count that exceeds the actual number of cycles.

Example scenario:

  1. An order is listed at round 10.

  2. setMarketParameters() is called, setting marketParameters.timestamp to the exact end of the current cycle.

  3. UserAgent::getRoundPhase() calculates the round as 11, instead of 10.

  4. This unexpected round increment causes the order to be skipped in UserAgent::purchase(), which now attempts to purchase orders at round 11, leaving round 10 orders unprocessed.

Impact

The incorrect round calculation can lead to missed purchases, as orders listed in the actual round are skipped.

Tools Used

vscode

Recommendations

Remove the additional offset rounds when elapsedTime % cycleTime is zero.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.