QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Future Timestamp in lastPoolUpdateRun Causes Temp DoS in performUpdate

efccweb3

Summary

The InitialisePoolLastRunTime function in the contract allows an admin or authorized user to set the lastPoolUpdateRun timestamp for a pool. However, there is no validation to ensure that the provided timestamp is not in the future. If a future timestamp is mistakenly set, it will cause the performUpdate function to revert indefinitely until the blockchain’s block.timestamp catches up, leading to a Denial of Service (DoS) for pool updates.

Vulnerability Details

function InitialisePoolLastRunTime(address _poolAddress, uint40 _time) external {
...
poolRuleSettings[_poolAddress].timingSettings.lastPoolUpdateRun = _time;
emit PoolLastRunSet(_poolAddress, _time);
}
function performUpdate(address _pool) public {
...
require(
block.timestamp - settings.timingSettings.lastPoolUpdateRun >= settings.timingSettings.updateInterval,
"Update not allowed"
);
...
}

If lastPoolUpdateRun is set to a future timestamp, the condition in performUpdate will fail:

block.timestamp - settings.timingSettings.lastPoolUpdateRun >= settings.timingSettings.updateInterval

The subtraction block.timestamp - settings.timingSettings.lastPoolUpdateRun will result in a negative value, causing the require statement to revert indefinitely.

Impact

Pool updates will be blocked until the block.timestamp catches up to the future value of lastPoolUpdateRun.

Tools Used

Manual Review

Recommendations

Ensure _time is not in the future in the InitialisePoolLastRunTime function:

require(_time <= block.timestamp, "FUTURE_TIMESTAMP_NOT_ALLOWED");
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.