Hardcoded block numbers will lead to unsuccessful off-boarding

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L36

Vulnerability details

Impact

Off-boarding is with a duration of 46523 blocks (7 days), calculated from block.number on the Ethereum chain 13 sec/block, but the development team wants to deploy in L2 chains as well:

• Deployment: we anticipate to launch on Ethereum mainnet & L2s like Arbitrum.

There is no way to change the off-boarding duration and most of the proposals on the L2 chains will fail due to the high amount of votes required in a short amount of period.

Proof of Concept

https://github.com/0xJuancito/multichain-auditor?tab=readme-ov-file#block-production-may-not-be-constant
The most widely used L2 chains are Arbitrum, Optimism, and Polygon zkEVM. But the average block time is different on all of them:

• Arbitrum - 0.26 sec
• Optimism - 2 sec
• Polygon zkEVM - 7 sec

On Optimism 46523 blocks will pass for approximately 26 hours as there are 1800 blocks per hour.

If we take Arbitrum 46523 blocks will pass for approximately 3 hours and 36 minutes as there are 13846 blocks per hour.

We can see from the proposals (GIP_0.sol) 10_000_000e18 set as an OFFBOARD_QUORUM and we can conclude that there is no way quorum to be satisfied within 216 minutes.

Governor can change the quorum for a given LendingTermOffboarding.sol contract but this exposes risk as this will significantly decrease the decentralization.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider allowing the deployer to set the POLL_DURATION_BLOCKS from the constructor instead of assigning it to constant.

Assessed type

Math

[c4-pre-sort]

0xSorryNotSorry marked the issue as sufficient quality report

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #1131

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #1012

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #816

[c4-judge]

Trumpero changed the severity to QA (Quality Assurance)

[c4-judge]

Trumpero marked the issue as grade-b

[c4-judge]

Trumpero marked the issue as grade-a