search

code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

block timestamp manipulation can cause fees change #195

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

aga7hokakological

Vulnerability details

Impact

Timestamp of the block can be manipulated by the miner which can cause change in the fees.

Proof of Concept

uint256 timeDiff = (block.timestamp - lastFee); in this line if lastFee variable is known then if miner with more computation can manipulate the timestamp which can make the difference equal to 0 which might result in variable fee to be 0.

Tools Used

Manual Analysis

Recommended Mitigation Steps

Don't use block.timestamp directly in contract.

GalloDaSballo commented 2 years ago

This finding would be valid if fees were related to time, but the reality is that fees are just streamed / unlocked over time. So skipping up to 15 seconds has literally no impact.

Will downgrade to low as the finding is factually correct, but there's no funds at risk