code-423n4 / 2021-09-sushitrident-2-findings

0 stars 0 forks source link

uint32 for timestamps #63

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

function addIncentive casts block.timestamp to uint32 and startTime/endTime are stored in uint32 while other functions like reclaimIncentive, subscribe, claimReward and getReward do not cast and use a raw value of uint256: uint32 current = uint32(block.timestamp); While uint32 should be sufficient for more than enough (the year 2106), it would still look better and robust if you unify the usage of timestamps across functions and contracts.

Recommended Mitigation Steps

As you probably want to save gas by storing it in uint32, I recommend exposing a separate util function that returns uint32 representation of block.timestamp that you can re-use where needed.