search

code-423n4 / 2021-04-vader-findings

1 stars 0 forks source link

_recordBurn calls _updateEmission afterwards #279

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

paulius.eth

Vulnerability details

Impact

contract Vether4 function _recordBurn first does all the calculations and only at the end calls _updateEmission(). This means that in theory last user still contributes to the previous day even though this day has already passed. So it is possible to write a custom smart contract that does all these actions in one tx: 1) burns ether (catch the moment when the time passed the next day time but is not yet recorded by _updateEmission). 2) withdrawShare (_updateEmission is already called and the day has shifted). 3) sells the acquired VETHER for ETH on AMM for profit or reverts.

Recommended Mitigation Steps

Always call _updateEmission first or even better, extract it to a modifier which you can put in front of the function.

strictly-scarce commented 3 years ago

Vether out of scope, and this behaviour is intended to flip the day.