sherlock-audit / 2022-09-notional-judging

4 stars 2 forks source link

Chom - Boosted3TokenAuraVault and MetaStable2TokenAuraVault will only be usable until February 7, 2106 #119

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

Chom

high

Boosted3TokenAuraVault and MetaStable2TokenAuraVault will only be usable until February 7, 2106

Summary

Boosted3TokenAuraVault and MetaStable2TokenAuraVault will only be usable until February 7, 2106

Vulnerability Detail

context.baseStrategy.vaultState.lastSettlementTimestamp = uint32(block.timestamp);
...
context.baseStrategy.vaultState.lastPostMaturitySettlementTimestamp = uint32(block.timestamp);
...
context.baseStrategy.vaultState.lastSettlementTimestamp = uint32(block.timestamp);
...
context.baseStrategy.vaultState.lastPostMaturitySettlementTimestamp = uint32(block.timestamp);

block.timestamp is converted to uint32 which has a max value of 4294967295. 4294967295 is February 7, 2106. After February 7, 2106, uint32(block.timestamp) will be overflowed. Once it is overflowed, the logic of the contract will be broken.

Impact

After February 7, 2106. Boosted3TokenAuraVault and MetaStable2TokenAuraVault won't be usable. Migration takes costs and is risky. You shouldn't pass on this work to future programmers. You should fix it in the first place. In case anything went wrong during migration, a big fund loss will occur.

Code Snippet

https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/Boosted3TokenAuraVault.sol#L123

https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/Boosted3TokenAuraVault.sol#L147

https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/MetaStable2TokenAuraVault.sol#L128

https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/MetaStable2TokenAuraVault.sol#L152

Tool used

Manual Review

Recommendation

Use bigger uint to store timestamps such as uint40 or more

Duplicate of #134