The core of the issue lies in the timing between two critical function calls: notifyRewardAmount(): This function is called to start a new reward period and to set the amount of rewards that will be distributed during this period. stake(): This function is used by stakers to stake their tokens and begin earning rewards. The problem arises when there is a delay (Y) between the execution of notifyRewardAmount() and the first call to stake() in a new reward period. Here’s a step-by-step explanation: Step 1: At block timestamp X, notifyRewardAmount() is called, initiating a new reward period intended to last for 2,592,000 seconds (one month). Step 2: There is a delay of Y seconds before the first stake() call is made. For example, if Y is 1,800 seconds (30 minutes), then no tokens are staked to earn rewards during these 1,800 seconds. Step 3: Because the reward distribution is set to end at X + 2,592,000 seconds (the end of the month from the start time), the rewards that would have been distributed during the initial 1,800 seconds (when no tokens were staked) remain undistributed and are essentially locked in the contract until the next reward period begins. Consequences This delay results in: Underutilization of Rewards: The 1,800 tokens that could have been distributed during the initial delay remain unused. This means less overall distribution of rewards during the period, which is inefficient. Locked Rewards: These undistributed rewards are locked in the contract and do not benefit any stakers. They only become relevant or usable in the next reward cycle, which could potentially lead to discrepancies in reward expectations and planning for stakers.
Your Onchain Transaction Feed | Cielo
Check out recent transactions for wallets you’re following in Cielo. Filter results by chain, tx type, and USD value. The alpha starts here.
Synthetix Staking Rewards Issue - Inefficient Reward Distribution
Zhuo Zhang | Purdue CS | Offside Labs on X: "1/7 📷 Attention Web3 hackers and developers! Ever hit a snag with a (forked) on-chain contract revert while working on PoC for bug bounties, or found yourself puzzled by complex contracts like Uniswap v3? Check out what we're showcasing in the video! https://t.co/pL0KFG3KXv" / X
1/7 📷 Attention Web3 hackers and developers! Ever hit a snag with a (forked) on-chain contract revert while working on PoC for bug bounties, or found yourself puzzled by complex contracts like Uniswap v3? Check out what we're showcasing in the video!https://t.co/pL0KFG3KXv— Zhuo Zhang | Purdue CS | Offside Labs (@i2huer) April 3, 2024
Security Incidents
This list documents exploit with associated amounts exceeding $100K.
MiloTruck/audit-notes: A random compilation of notes for auditing
A random compilation of notes for auditing. Contribute to MiloTruck/audit-notes development by creating an account on GitHub.
minaminao/ctf-blockchain: A summary of 100+ CTF blockchain challenges
A summary of 100+ CTF blockchain challenges. Contribute to minaminao/ctf-blockchain development by creating an account on GitHub.
Vyper.fun
Learn Vyper by building a Pokemon Game. Study structure of a contract, types, variables and constants, statements, control structures, scoping and declarations, built-in functions, interfaces, event logging, natspec metadata
TWAP Oracles For Auditors
What is a TWAP?
A TWAP oracle is a Time-weighted average price oracle that calculates the average price of an asset over some predetermined period of time. If a user wants to know the price of ETH over 28 days then the TWAP will return the average pr...
kongqp/DeFiTainter
Contribute to kongqp/DeFiTainter development by creating an account on GitHub.
Compound V3 Book | RareSkills
The RareSkills Compound V3 book is a line-by-line examination of the Compound V3 protocol. We explain the tokenomics, architecture, and the code in great detail — down to the number of decimals certain variables have.
Exploring the DeFi Perpetual Futures Landscape - Part I
DeFi Perpetuals Landscape 2023
Cracks in the Code: Understanding the Vulnerabilities of AMM Pro… — millie
Introduction — EVM from Scratch
chinmay-farkya/EVM-notes
Contribute to chinmay-farkya/EVM-notes development by creating an account on GitHub.
The AMM Book | Technical Glossary
The Ultimate Guide to Automated Market Makers in Decentralized Finance
EVM Opcodes & Solidity Gas Mastery Tutorial | Cyfrin Updraft Assembly & Formal Verification Excerpt
This is an excerpt from the upcoming Assembly, Opcodes, and Formal Verification course. We go over the following in this video:
- How to write a smart contract in Opcodes (with Huff!)
- How to disassemble a smart contract
- How to read the bytecode of a smart contact (without it even being verified on Etherscan!)
- How to write Yul/Inline assembly in Solidity
- How to truly become a gas optimization professional using low-level programming languages
- How the Opcodes in the EVM work
GitHub repo associated with this video: https://github.com/Cyfrin/1-horse-store-s23
GitHub Repo for the coming course: https://github.com/Cyfrin/assembly-evm-opcodes-and-formal-verification-course
Security Course on Updraft: https://updraft.cyfrin.io/courses/security
Register for Cyfrin Updraft: https://updraft.cyfrin.io/
⏰ Timestamps ⏰
0:00:00 | Introduction
0:02:57 | Horse Store - Huff & Opcodes
2:07:39 | Breaking down solidity compiled opcodes
3:24:47 | Yul
3:48:40 | HorseStoreV2 - Huff
4:28:30 | Gas Comparisons & Summary
😸😸Follow Patrick!😸😸
Cyfrin: https://www.cyfrin.io/
YouTube: https://www.youtube.com/@PatrickAlphaC/videos
Twitter: https://twitter.com/patrickalphac
Medium: https://medium.com/@patrickalphac
TikTok: https://www.tiktok.com/@patrickalphac
🛡️ More Cyfrin
CodeHawks: https://codehawks.com/
Solodit: https://solodit.xyz/
Updraft: https://updraft.cyfrin.io/
All thoughts and opinions are my own.
Yield Aggregators in DeFi
This article summarizes the paper ‘SoK: Yield Aggregators in DeFi’, a joint work between UCL CBT and Imperial College London.
Reverse Engineering Rustlang Binaries - A Series | BrightProgrammer
I’ve been struggling with reverse engineering rustlang binaries for a while in CTF challenges. So I’m starting a reverse engineering series where I reverse engineer several rustlang binariesa and try to understand how they actually work.
Exchange Rate Manipulation in ERC4626 Vaults - Euler Finance
PRice Manipulation , Shares manipulation, Initial supply
🪄 Using this Book - Polkadot Blockchain Academy
The materials used in the Polkadot Blockchain Academy
audits/solo/README.md at master · pashov/audits
Contribute to pashov/audits development by creating an account on GitHub.
Options, swaps, futures, MBSs, CDOs, and other derivatives | Khan Academy
Important finance course
Dimitar Tsvetanov on Twitter / X
You can read about common attack vectors in AMM protocols in this article. There is also a Checklist at the end to look at when auditing👇🏼https://t.co/GUov1MwIGI— Dimitar Tsvetanov (@cvetanovv0) January 3, 2024
Fave on X: "Are you competing in @code4rena @CreditGuild audit contest. Here are some cool resources to look into https://t.co/oSHUFhespb https://t.co/zEqFfJhLEW https://t.co/EJfWVouCRu https://t.co/tuXCI0YVmi" / X
What is liquidation, compound finance etc.
jtriley-eth/the-ethereum-virtual-machine
Contribute to jtriley-eth/the-ethereum-virtual-machine development by creating an account on GitHub.
Uniswap V2 Book | RareSkills
A deep dive into the source code, tokenomics, and math behind the most copied DeFi protocol
Swiss Knife
Calldata Decode/Encode blockchain
uniswap.university/courses/view/getting-started-with-uniswap
Owen | Guardian Audits 🛡️ on X
GMX v2 testcases
ONLYPWNER - EVM CTF Platform
Elevate your skills, compete against other enthusiasts, and join a community of passionate security researchers