Submission Details
Severity:
Using both `block.timestamp` and `block.number` in `blockTimestampDeposit`
Summary
The both block.timestamp and block.number parameters are used in the blockTimestampDeposit variable. This way there can be discrepancy of values in the storage.
Vulnerability Details
The both block.timestamp and block.number parameters are used:
function addLiquidityProportional(
address pool,
uint256[] memory maxAmountsIn,
uint256 exactBptAmountOut,
bool wethIsEth,
bytes memory userData
) external payable saveSender(msg.sender) returns (uint256[] memory amountsIn) {
<...>
poolsFeeData[pool][msg.sender].push(
FeeData({
tokenID: tokenID,
amount: exactBptAmountOut,
//this rounding favours the LP
lpTokenDepositValue: depositValue,
//known use of timestamp, caveats are known.
>> blockTimestampDeposit: uint40(block.timestamp), //@audit blocknumber is used when afterupdate
upliftFeeBps: upliftFeeBps
})
);
nftPool[tokenID] = pool;
}
<...>
function afterUpdate(address _from, address _to, uint256 _tokenID) public {
<...>
if (tokenIdIndexFound) {
if (_to != address(0)) {
// Update the deposit value to the current value of the pool in base currency (e.g. USD) and the block index to the current block number
//vault.transferLPTokens(_from, _to, feeDataArray[i].amount);
feeDataArray[tokenIdIndex].lpTokenDepositValue = lpTokenDepositValueNow;
>> feeDataArray[tokenIdIndex].blockTimestampDeposit = uint32(block.number);
feeDataArray[tokenIdIndex].upliftFeeBps = upliftFeeBps;
Impact
Saving in storage incorrect values.
Tools used
Manual Review
Recommendations
Consider fixing the discrepancy.
Updates
Lead Judging Commences
n0kto 7 months ago
Submission Judgement Published Assigned finding tags:
finding_afterUpdate_blockNumber_instead_of_timestamp
Likelihood: Medium/High, any NFT transfer will change this variable. Impact: Informational/Very Low. This variable is unused and won’t impact anything, but the array is public and its getter will return a variable with inconsistencies.
Prize pool breakdown
Total prize
49,600 OP
nSLOC
3,00017 OP / LOC
44,640
4,960
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.