Core Contracts

Summary

calculateTimeWeightedAverage does not normalize overlapping periods or validate inputs, leading to incorrect results

Vulnerability Details

The function attempts to calculate a weighted average using this formula:

This is mathematically incorrect because:

• Numerator: Sum of (value × duration × weight) for all periods.

• Denominator: totalDuration × 1e18 (total duration across periods × fixed scaling factor).

correct formula below:
weightedAverage = (Σ(value × duration × weight)) / Σ(duration × weight)

• Denominator must be the sum of duration × weight for all periods, not totalDuration × 1e18.

The current implementation uses totalDuration (sum of durations) multiplied by 1e18 as the denominator. This:

• Ignores individual period weights in the denominator.

• Incorrectly assumes all weights are 1e18 (equivalent to a weight of 1.0).

Example:

• Period 1:
  startTime=0, endTime=100 (duration=100), value=10, weight=0.5e18.

• Period 2:
  startTime=100, endTime=300 (duration=200), value=20, weight=1.5e18.

• Timestamp: 300.

Incorrect calculation from the above code:

Correct calculation should be:

The weights are misapplied because code treats 1e18 as a global scaling factor for weights, but weights are already scaled (e.g., 0.5e18 represents 0.5).

Denominator is incorrect because of using totalDuration * 1e18 instead of summing duration × weight per period.

Impact

Periods with weights ≠ 1e18 are misrepresented. In the example, Period 2’s weight (1.5x) is diluted because the denominator treats all weights as 1.0.

Results deviate significantly from true time-weighted values.

Tools Used

Manual Review

Recommendations

Add a variable to accumulate Σ(duration × weight). Modify the loop to track both sums and use correct denominator