Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect Lock Time Check in Withdraw in PerpetualVault.sol

hunterspartan5

Summary

The withdraw function contains an incorrect lock time check that prevents withdrawals at the exact unlock time.

Vulnerability Details

Location

withdraw function

Issue

The condition:

if (depositInfo[depositId].timestamp + lockTime >= block.timestamp) {
revert Error.Locked();
}

incorrectly uses >=, which prevents users from withdrawing even when the lock time has precisely elapsed. This means users must wait an extra block before they can withdraw, which is not the intended behavior.

Impact

  • Users experience unnecessary delays in withdrawing their collateral.

  • Creates a poor user experience due to an unintended restriction.

Tools Used

  • Manual code review

  • Static analysis

Recommendations

Change the condition to:

if (block.timestamp < depositInfo[depositId].timestamp + lockTime) {
revert Error.Locked();
}

This ensures that users can withdraw as soon as the lock time has fully passed, without any additional delay.

Updates

Lead Judging Commences

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.