-
Notifications
You must be signed in to change notification settings - Fork 11
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Hardcoded POLL_DURATION_BLOCKS
causes lending term offboarding polls' lifetime to be too short for voting on several chains
#1131
Comments
0xSorryNotSorry marked the issue as sufficient quality report |
0xSorryNotSorry marked the issue as primary issue |
0xSorryNotSorry marked the issue as duplicate of #1012 |
0xSorryNotSorry marked the issue as duplicate of #816 |
Trumpero changed the severity to QA (Quality Assurance) |
Trumpero marked the issue as grade-b |
Trumpero marked the issue as grade-c |
Hi @Trumpero, Whereas #816 (primary issue) got a This issue refers to the incorrect Please let me clarify why mentioning the constant in the @> /// @dev voting period is unused, it is a duration in blocks for the vote
@> /// but the timestamp of the action in the timelock is used to know if the
@> /// vote period is over (after action is ready in the timelock, the veto
@> /// vote failed).
function votingPeriod() public pure override returns (uint256) {
return 2425847; // ~1 year with 1 block every 13s
} The Since the For this reason, #816 is partially valid, while this issue is more accurate. |
@serial-coder When an issue is downgraded to QA, it will be included in the QA report of that warden, then all QA issues of that warden will be label a same grade based on their QA points. After combining all QA issues of this warden, their QA point is still not enough to reach grade-b in my evaluation. Therefore, all issues of this warden are marked as grade-c. |
Lines of code
https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L36
https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L94-L97
https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L120-L123
Vulnerability details
The
Ethereum Credit Guild
protocol is anticipated to launch on Ethereum Mainnet & L2s like Arbitrum, Optimism, etc.In the
LendingTermOffboarding
contract, thePOLL_DURATION_BLOCKS
constant defines the lifetime of all lending term offboarding polls. The contract hardcoded the value of thePOLL_DURATION_BLOCKS
to 46523, which is ~7 days on Ethereum Mainnet (at 13s / block).However, other chains have different block times. For instance, 2s for Optimism/Polygon/Avalanche/Base, 3s for BNB Chain, 1.13s for Fantom, etc. Therefore, the lending term offboarding polls will stay open for ~1 day on Optimism/Polygon/Avalanche/Base, ~1.6 days on BNB Chain, and ~14.6 hours on Fantom.
Consequently, the vote for offboarding terms on the above chains may not succeed as expected since the lifetime of the polls is too short for voting, causing damage to the protocol and users.
Proof of Concept
The
LendingTermOffboarding
contract fixed thePOLL_DURATION_BLOCKS
constant to 46523. ThePOLL_DURATION_BLOCKS
determines the lifetime of all lending term offboarding polls in theproposeOffboard()
andsupportOffboard()
, as shown below.@1
: https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L36@2
: https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L94-L97@3
: https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/LendingTermOffboarding.sol#L120-L123Tools Used
Manual Review
Recommended Mitigation Steps
Do not use the hardcoded
POLL_DURATION_BLOCKS
. It should be an immutable variable configurable by a contract deployer via theconstructor()
.It is important to note that on Arbitrum, the
block.number
will be updated to sync with Ethereum Mainnet'sblock.number
approximately every minute. Thus, the Arbitrum'sblock.number
will be similar to the Ethereum Mainnet'sblock.number
over time. In other words, thePOLL_DURATION_BLOCKS
for Arbitrum could be the same as the Ethereum Mainnet.Assessed type
Other
The text was updated successfully, but these errors were encountered: