Vulnerability Report: Calendar Misalignment Risk in RWAGauge

Summary

The current implementation of the RWAGauge contract uses a fixed duration of 30 days for its monthly periods. This approach leads to a drift from real calendar months, which can cause misalignment with real-world financial reporting cycles. While the drift is less severe than initially hypothesized, it still poses potential issues for users relying on accurate timing for governance and financial decisions.

Current Code Issue

The relevant code snippet is as follows:

Issue

• 30-Day Months Drift: The use of a fixed 30-day duration causes the periods to drift from actual calendar months, accumulating approximately 10 days of drift per year.

• Impact on Financial Reporting: This misalignment can lead to discrepancies in financial reporting and governance activities that depend on accurate month-end calculations.

Concrete Example

Drift Analysis

Test Results

The test results confirmed the calendar misalignment issue, revealing the following patterns:

1. Initial Alignment: Month 1 starts perfectly aligned (Jan 1st).

2. Drift Pattern:

   • Month 2 (February): 1 day drift.

   • Month 3 (March): 1 day drift.

   • Month 4 (April): Returns to alignment (30 days).

   • Month 5 (May): Stays aligned.

   • Month 6 (June): 1 day drift.

3. Key Findings:

   • The drift is not as severe as initially hypothesized (maximum of 1 day).

   • The system self-corrects during 30-day months.

4. Impact Assessment:

   • The drift is less severe than initially thought, but still present.

   • Most noticeable in 31-day months and February.

Recommendations

1. Implement Calendar-Aware Period Management:

   • Transition to a system that uses block timestamps aligned to UTC months.

   • Implement a calendar-aware period manager that adjusts for varying month lengths.

2. Consider Acceptable Drift:

   • If the maximum drift of 1 day is acceptable for the use case, the current implementation may suffice.

   • However, for applications requiring precise timing, a more robust solution is recommended.

3. Monitor and Adjust:

   • Continuously monitor the impact of the drift on user interactions and governance decisions.

   • Be prepared to adjust the implementation if user feedback indicates significant issues.