search

code-423n4 / 2023-08-pooltogether-mitigation-findings

0 stars 0 forks source link

M-03 MitigationConfirmed #43

Open code423n4 opened 1 year ago

code423n4 commented 1 year ago

Lines of code

Vulnerability details

Issue mitigated

About the problem

As described in the docs, pool together twab can't guarantee correct historical balances information for the periods that are not finalized yet, because they can be overwritten(observation will be updated) and balance can be manipulated in case if it is searched for such not finalized periods. Such problem was described in this report, which states, that getTwabBetween function doesn't check that _startTime and _endTime are timestamps in the finalized periods.

Solution

Pool together has fixed that issue. Now they convert each timestamp to the corresponding period start timestamp and check that this timestamp is already finalized. So as result, request for the historical balances for the timestamps that are not finalized yet will revert and this bug is not present anymore.

c4-judge commented 1 year ago

Picodes marked the issue as satisfactory