search

code-423n4 / 2022-06-nibbl-findings

1 stars 0 forks source link

[PNM-003] TWAV: The TWAV window is too small #268

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-06-nibbl/blob/8c3dbd6adf350f35c58b31723d42117765644110/contracts/Twav/Twav.sol#L12

Vulnerability details

Description

The window of TWAV is only 4 blocks, which is only 1 minute on Ethereum. Many layer-2 blockchains even have a much shorter block time. Attackers can easily manipulate the value.

We have seen a lot of hacks regarding to the short window in the wild, some typical ones are cited as follows.

Suggested Fix

Increase the window size.

GalloDaSballo commented 2 years ago

Finding doesn't have code / POC but is going for a High Severity

HardlyDifficult commented 2 years ago

Without an exploration of the potential impact here as it relates to Nibbl or a POC, this is QA type feedback. Merging with the warden's QA report #264