Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`TimeWeightedAverage.createPeriod` initialize `Period.totalDuration` to wrong value

infect3d

Summary

createPeriod initialize Period.totalDuration to duration, while it should be initialized to zero, as totalDuration represents the total duration of accumulated values.
This mistake causes an inflated totalDuration

Vulnerability details

Let's see what happen to totalDuration when we create a period and then update it, and if it seems correct.
Let's fix block.timestamp = 0 for simplicity purpose.
First, if we create a period with startTime = 0 and a duration of 3600 seconds, we get:

  • period.totalDuration = 3600

  • and lastUpdateTime = 0

File: contracts/libraries/math/TimeWeightedAverage.sol
102: function createPeriod(
...:
...: //* ------------ some code ------------- *//
...:
115:
116: self.startTime = startTime;
117: self.endTime = startTime + duration;
118: self.lastUpdateTime = startTime;
119: self.value = initialValue;
120: self.weightedSum = 0;
121: self.totalDuration = duration; <@ we ge totalDuration = 3600
122: self.weight = weight;
123:
124: emit PeriodCreated(startTime, duration, initialValue);
125: }

Now, let's move to block.timestamp = 1800 and call updateValue() (whatever the new value):

  • duration = 1800 - 0 = 1800 which is correct, 1800 second has elapsed since last update of the period

  • totalDuration += duration which is totalDuration = 3600 + 1800
    But only 1800 seconds have elapsed yet.

File: contracts/libraries/math/TimeWeightedAverage.sol
134: function updateValue(
135: Period storage self,
136: uint256 newValue,
137: uint256 timestamp
138: ) internal {
139: if (timestamp < self.startTime || timestamp > self.endTime) {
140: revert InvalidTime();
141: }
142:
143: unchecked {
144: uint256 duration = timestamp - self.lastUpdateTime;
145: if (duration > 0) {
146: uint256 timeWeightedValue = self.value * duration;
147: if (timeWeightedValue / duration != self.value) revert ValueOverflow();
148: self.weightedSum += timeWeightedValue;
149: self.totalDuration += duration;
150: }
151: }
152:
153: self.value = newValue;
154: self.lastUpdateTime = timestamp;
155: }

Impact`

totalDuration will not represent a correct value, which will cause issues in future integration of the library.

Recommended Mitigation Steps

Initialize period.totalDuration to 0 on creation.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimeWeightedAverage::createPeriod incorrectly initializes totalDuration to period duration instead of zero, causing double-counting and inflated duration accumulation

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

TimeWeightedAverage::createPeriod incorrectly initializes totalDuration to period duration instead of zero, causing double-counting and inflated duration accumulation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.