Dria

Summary

The getRoundPhase function in the BuyerAgent contract uses an incorrect calculation for elapsed time, where idx + 1 is mistakenly utilized to determine time differences between market parameters. This issue leads to incorrect phase calculations, potentially affecting key contract operations tied to specific time-based logic. As a result, phases that control purchasing, withdrawals, or other round-specific operations may yield inaccurate data, which could restrict user actions or misalign phase-based events.

Vulnerability Details

The vulnerability arises from the use of idx + 1 in calculating the elapsed time for determining the current phase. Specifically, the function utilizes marketParams[idx + 1].timestamp to compute the difference in time from createdAt, which does not accurately capture the intended elapsed time. This calculation flaw can lead to inaccurate round and phase data, resulting in disruptions across the contract’s functionalities that depend on precise time tracking.

Code Snippet

Impact

The incorrect calculation leads to erroneous phase determinations, disrupting operations that rely on the accurate sequencing of contract rounds. This discrepancy affects:

• Purchasing and Withdrawal: Users may be unable to initiate purchases or withdrawals as expected, particularly if the contract enforces strict timing conditions.

• Funds Accessibility: In cases where the contract locks or restricts funds based on specific phases, the miscalculated phases may prevent legitimate fund access, potentially resulting in unintentional funds lockup.

Recommendation

To fix this issue, modify the calculation to use the correct timestamps that accurately represent elapsed time without referencing idx + 1 inappropriately. Ensuring idx points to the current relevant market parameter should eliminate this discrepancy:

1. Update the getRoundPhase function to use the correct marketParams[idx].timestamp.

2. Refactor _computePhase invocations to reflect accurate elapsed time computations, aligning phase logic with intended market conditions.