The protocol timelock duration assumes 4 blocks per minute i.e. 15s blocks whereas the current block time is ~13s and which is variable. This granularity/accuracy should be ok for current timelock purposes where a few seconds difference should not matter but recommend using seconds and block.timestamp instead of block.number for more granular/accurate time-based accounting.
GalloDaSballo
commented
2 years ago
Handle
0xRajeev
Vulnerability details
Impact
The protocol timelock duration assumes 4 blocks per minute i.e. 15s blocks whereas the current block time is ~13s and which is variable. This granularity/accuracy should be ok for current timelock purposes where a few seconds difference should not matter but recommend using seconds and block.timestamp instead of block.number for more granular/accurate time-based accounting.
Proof of Concept
https://github.com/code-423n4/2021-09-defiProtocol/blob/52b74824c42acbcd64248f68c40128fe3a82caf6/contracts/contracts/Basket.sol#L15
https://etherscan.io/chart/blocktime
Tools Used
Manual Analysis
Recommended Mitigation Steps
Consider using block.timestamp instead of block.number for more granular/accurate time-based accounting.