The docs explain how some NFTs will age to their full potential (claiming 50% of the nuke fund) in 30 days and others in 600 days. However, that's not the case because the current aging implementation is too slow.
Proof of Concept
calculateAge calculates the age of an NFT. calculateNukeFactor multiplies that age by defaultNukeFactorIncrease and combines it with initialNukeFactor to get the finalNukeFactor. The age should account for 25% of the Nuke factor (best case).
In the docs, it is described that NFTs should mature between 30 and 600 days. We take the best-case scenario: 25% of the nuke factor is made by age and performanceFactor = 9 (our highest possible value).
Also, ageMultiplier would be 1. It's used only for testing, as stated by the sponsor:
pickpeak1024 — 08/01/2024 12:58 PM
what is the value of agemultiplier @ManPeach.0x
ManPeach.0x — 08/01/2024 1:00 PM
Ignore it. It will be removed as it was used for testing
Finally, when used inside nuke to calculate our portion of the nuke funds, it will return 0.184% of our fund. However, we should have expected 25% of the fund (not accounting initialNukeFactor).
Lines of code
https://github.com/code-423n4/2024-07-traitforge/blob/main/contracts/NukeFund/NukeFund.sol#L166
Vulnerability details
Impact
The docs explain how some NFTs will age to their full potential (claiming 50% of the nuke fund) in 30 days and others in 600 days. However, that's not the case because the current aging implementation is too slow.
Proof of Concept
calculateAge calculates the age of an NFT. calculateNukeFactor multiplies that age by
defaultNukeFactorIncrease
and combines it withinitialNukeFactor
to get thefinalNukeFactor
. The age should account for 25% of the Nuke factor (best case).In the docs, it is described that NFTs should mature between 30 and 600 days. We take the best-case scenario: 25% of the nuke factor is made by age and
performanceFactor
= 9 (our highest possible value).Also,
ageMultiplier
would be 1. It's used only for testing, as stated by the sponsor:calculateAge will calculate an age of
73972
.When used inside calculateNukeFactor, it will return
184 + initialNukeFactor
.Finally, when used inside nuke to calculate our portion of the nuke funds, it will return
0.184%
of our fund. However, we should have expected 25% of the fund (not accountinginitialNukeFactor
).Tools Used
Manual review
Recommended Mitigation Steps
Adjust the aging math to match the docs.
Assessed type
Error