Core Contracts

Summary

There is a redundant check in the function TimeWeightedAverage::updateValue that can cause unnecessary transaction failures. The condition if (timeWeightedValue / duration != self.value) revert ValueOverflow(); is incorrectly used to detect overflow, but in reality, it checks whether self.value is a multiple of duration, which is not necessary.

Vulnerability Details

The function TimeWeightedAverage::updateValue is responsible for updating the time-weighted value of a parameter over a given period. However, the following line introduces an unnecessary restriction:

• This condition does not correctly detect overflow.

• In Solidity, multiplication followed by division (x * y / y) is a common pattern to ensure values remain a multiple of the divisor.

• The check instead enforces that self.value must be exactly divisible by duration, which is not required and will frequently cause transaction failures.

• Many valid values of self.value may not be exact multiples of duration, leading to unnecessary transaction reverts.

Key Issue in Code:

• If self.value is not an exact multiple of duration, the condition will fail, even though no overflow occurs.

Impact

• Unnecessary transaction failures, affecting protocol operations.

• Incorrect use of overflow detection, making the function unreliable.

• Inconsistent time-weighted calculations, potentially leading to governance or reward miscalculations.

Tools Used

• Manual review

Recommendations

• Remove the redundant check: