QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Valid

`blockTimestampDeposit` variable assigned incorrectly

newspacexyz

Summary

In the afterUpdate function, the blockTimestampDeposit variable is assigned the current block number instead of the current block timestamp:

feeDataArray[tokenIdIndex].blockTimestampDeposit = uint32(block.number);

Although the incorrect assignment does not affect the current contract logic, it introduces confusion and potential maintenance issues.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L610

Vulnerability Details

Problematic Code:

feeDataArray[tokenIdIndex].blockTimestampDeposit = uint32(block.number);

  • Issue: The variable blockTimestampDeposit is incorrectly assigned block.number, which is not a timestamp.

  • Expected Behavior: If blockTimestampDeposit is intended to track a deposit timestamp, it should be assigned block.timestamp.

Impact

  • Time Tracking Inaccuracy: This can cause confusion or errors if the variable is used for time-based calculations in the future..

  • Code Redundancy: An unused variable introduces unnecessary complexity and confusion for developers maintaining the code.

While this issue does not currently affect functionality, it reflects poorly on the code’s clarity and maintainability.

Tools Used

Recommendations

Option 1: Update the Assignment (If the Variable is Needed)

If blockTimestampDeposit is intended to track a deposit’s timestamp for future use:

feeDataArray[tokenIdIndex].blockTimestampDeposit = uint32(block.timestamp);
Updates

Lead Judging Commences

n0kto Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_afterUpdate_blockNumber_instead_of_timestamp

Likelihood: Medium/High, any NFT transfer will change this variable. Impact: Informational/Very Low. This variable is unused and won’t impact anything, but the array is public and its getter will return a variable with inconsistencies.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.