code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

TIMELOCK_DURATION is not set to 1 day #37

Closed code423n4 closed 2 years ago

code423n4 commented 3 years ago

Handle

jonah1005

Vulnerability details

Impact

TIMELOCK_DURATION is set to 46024. It should be 606024; Basket.sol#L15

Proof of Concept

This would fail.

require(4 * 60 * 24 == 1 days)

Tools Used

None

Recommended Mitigation Steps

Use 1 days instead.

frank-beard commented 2 years ago

this is intended as it refers to the block time/block number

GalloDaSballo commented 2 years ago

Because the sponsor intended TIMELOCK_DURATION to be in blocks, the finding is invalid

However, after all this flagging, I highly recommend the sponsor considers renaming the constant or to add a comment to make it obvious this is a block measure, not hours