Closed c4-bot-3 closed 10 months ago
raymondfam marked the issue as insufficient quality report
raymondfam marked the issue as duplicate of #277
MarioPoneder changed the severity to QA (Quality Assurance)
MarioPoneder marked the issue as grade-c
Hey, @MarioPoneder!
I strongly believe that this issue should be considered a valid Medium Severity issue. In my report, I clearly explain how the inaccuracy of block.number
affects the computation of the holding duration for votes. This impacts the _getPastVotes()
and getPastVotes()
functions, and subsequently, the piece voting flow
.
I respectfully request a reassessment of the issue, considering its significant impact. I feel its severity may have been underestimated.
Cheers!
P.S. Here are similar vulnerabilities that were considered valid Medium Severity Issues in previous Code4rena Contests:
On
Optimism
, theblock.number
is not a reliable source of timing information and the time between each block is also different from Ethereum. This is because each transaction on L2 is placed in a separate block and blocks are not produce at a constant rate. This will cause the holding duration computation using_getPastVotes()
to fluctuate. (see Optimism docs https://community.optimism.io/docs/developers/build/differences/#block-numbers-and-timestamps)
The linked reference doesn't even mention that block.number
is a problem on Optimism. Blocktime is ~2 on Optimism which causes not problems for voting.
Lines of code
https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/CultureIndex.sol#L274-L276 https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/CultureIndex.sol#L292-L298
Vulnerability details
Impact
The inaccuracy of (block.number) will affect the computation of the holding duration for the votes. That will affect
_getPastVotes()
,getPastVotes()
functions and subsequently to thepiece voting flow
..Proof of Concept
On
Optimism
, theblock.number
is not a reliable source of timing information and the time between each block is also different from Ethereum. This is because each transaction on L2 is placed in a separate block and blocks are not produce at a constant rate. This will cause the holding duration computation using_getPastVotes()
to fluctuate. (see Optimism docs https://community.optimism.io/docs/developers/build/differences/#block-numbers-and-timestamps)Recommendation migration Steps
Use
block.timestamp
rather thanblock.number
for more accurate measurement of time.Assessed type
Timing