Im_th3AK - `Block Timestamp` Dependence in Interest Calculation Functions

[sherlock-admin4]

Im_th3AK

medium

Block Timestamp Dependence in Interest Calculation Functions

Summary

The contract's interest rate calculation functions, such as fixedRate, rely on the block timestamp (block.timestamp), which can be slightly manipulated by miners. This could potentially affect the accuracy of interest calculations.

Vulnerability Detail

The Ethereum block timestamp can be influenced by miners within certain limits (approximately +/- 15 seconds). Contracts that use timestamps for logic related to time-sensitive operations may therefore have vulnerabilities if this manipulation affects contract outcomes.

Impact

If a miner manipulates the timestamp, it could lead to incorrect interest rate calculations or enable timing-based exploits. The impact is likely low-medium since there are natural limitations on how much miners can manipulate timestamps and because economic incentives generally discourage extreme manipulation.

Code Snippet

https://github.com/sherlock-audit/2024-04-interest-rate-model/blob/main/protocol/contracts/InterestRateModel.sol#L121-L122

Tool used

• Manual Review

  Recommendation

• Using an average of previous blocks' timestamps to mitigate single-point manipulation.
• Implementing a Time Oracle that provides signed timestamps from multiple trusted sources.
• Adding checks and balances around critical operations where exact timing matters significantly.

  
  import "./ITimeOracle.sol";

contract InterestRateModel { ITimeOracle public immutable timeOracle;

constructor(ITimeOracle _timeOracle) {
    // ... other initializations ...
    timeOracle = _timeOracle;
}

function fixedRate(uint256 maturity / other params /) public view returns (uint256) { uint256 currentTime = timeOracle.getCurrentTime(); v.maturityFactor = (maturity - currentTime).divWadDown( // ... rest of code ... );

  //... rest of fixedRate implementation...

} }

This would require deploying a separate Time Oracle contract with its own security considerations but would reduce dependency risks associated with miner-controlled variables like `block.timestamp`.

[santipu03]

There have been no miners in the Ethereum network since September 15th, 2022.