search

code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

Wrong constant for `ONE_DAY` #218

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

cmichel

Vulnerability details

The ONE_DAY constant in Auction estimates the blocks per day as 4 * 60 * 24 which would equal an average block time of 15 seconds.

The same issue exists for the Basket.TIMELOCK_DURATION

Impact

The auctions and timelocks are shorter than expected by the protocol developer, they are off by ~13%.

Recommended Mitigation Steps

Use a better estimate for your network. At the moment, a more accurate block time for the Ethereum mainnet would be 13.2s, see blocktime. Use 86400 / 13.2 = 6545 > 5760

GalloDaSballo commented 2 years ago

In stark comparison to other wardens, this finding speaks about an inaccuracy in the amount of blocks per day.

I agree with the finding, from my math the block time should be around 13.5 but we agree that there's rounding here