023.md

Nice Basil Panda

Medium

protocol will lose funds if auction settles is not happening on time more than 1 tick(day)

Summary

forwardAll inside StreamEscrow doesn't take into account that time passed can be more minimumTickDuration hence eth will be stuck in a contract forever.

Root Cause

As we can see from code below that no matter how much time passed since lastForwardTimestamp only one tick will be processed.

    function forwardAll() public {
        // silently fail if at least a day hasn't passed. this is in order not to revert auction house.
        if (block.timestamp < lastForwardTimestamp + minimumTickDuration) {
            return;
        }

        lastForwardTimestamp = toUint48(block.timestamp);

        sendETHToTreasury(ethStreamedPerTick);

        (uint32 newTick, uint128 ethPerTickEnded) = increaseTicksAndFinishStreams();

        emit StreamsForwarded(newTick, ethPerTickEnded, ethStreamedPerTick, lastForwardTimestamp);
    }

contracts/StreamEscrow.sol#L138

Internal pre-conditions

Protocol didn't settle auction on time

External pre-conditions

No response

Attack Path

No response

Impact

Protocol will lose ((block.timestamp - lastForwardTimestamp) / minimumTickDuration - 1) * ethStreamedPerTick eth when auction settle will not happen on time.

PoC

No response

Mitigation

process each tick that happens:

    function forwardAll() public {
        // silently fail if at least a day hasn't passed. this is in order not to revert auction house.
        if (block.timestamp < lastForwardTimestamp + minimumTickDuration) {
            return;
        }

        lastForwardTimestamp = toUint48(block.timestamp);
        uint ticks = (block.timestamp - lastForwardTimestamp + minimumTickDuration - 1 ) / minimumTickDuration;
        for (uint256 i; i < ticks; ++i) {
            sendETHToTreasury(ethStreamedPerTick);

            (uint32 newTick, uint128 ethPerTickEnded) = increaseTicksAndFinishStreams();

            emit StreamsForwarded(newTick, ethPerTickEnded, ethStreamedPerTick, lastForwardTimestamp);
        }
    }