Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing Time Delay Between Commit and Apply Operations

hamadiftikhar

Summary

The IBlockHashRetain.vyi interface lacks a mandatory time delay between commit and apply operations,which requires protection against get-or-create pattern vulnerabilities.

Vulnerability Details

The current implementation allows immediate application after commitment:

@external
def commit() -> uint256:
"""
@notice Commit (and apply) a block hash/state root.
@dev Same as `apply()` but saves committer
"""
...
​
@external
def apply() -> uint256:
"""
@notice Apply a block hash/state root.
"""
...

Critical issues:

  1. No minimum waiting period between commit and apply

  2. Both operations can occur in the same block

  3. No timestamp validation

  4. Allows instant finalization of potentially manipulated data

Impact

  • Manipulation of oracle data through rapid commit-apply sequences

  • No time for validators to verify committed values

  • Potential price manipulation in dependent protocols

  • Bypass of intended security checks

Tools Used

  • Manual Review

Recommendations

  1. Implement mandatory timelock:

MINIMUM_DELAY: constant(uint256) = 3600 # 1 hour delay
​
struct Commitment:
timestamp: uint256
block_number: uint256
is_applied: bool
​
commitment_data: public(HashMap[address, Commitment])
​
@external
def commit(_block_number: uint256) -> bool:
"""
@notice Commit a block hash with timelock
"""
self.commitment_data[msg.sender] = Commitment({
timestamp: block.timestamp,
block_number: _block_number,
is_applied: False
})
return True
​
@external
def apply() -> bool:
"""
@notice Apply after timelock expires
"""
assert block.timestamp >= self.commitment_data[msg.sender].timestamp + MINIMUM_DELAY, "Timelock not expired"
assert not self.commitment_data[msg.sender].is_applied, "Already applied"
self.commitment_data[msg.sender].is_applied = True
return True

  1. Add emergency pause mechanism:

@external
def emergency_pause():
"""
@notice Emergency pause for suspicious activity
"""
assert msg.sender == self.admin, "Not admin"
self.paused = True

This ensures adequate time for validation and prevents rapid manipulation attempts while maintaining protocol security.

Updates

Lead Judging Commences

0xnevi Lead Judge
6 months ago
0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.