The core of the issue lies in the timing between two critical function calls: notifyRewardAmount(): This function is called to start a new reward period and to set the amount of rewards that will be distributed during this period. stake(): This function is used by stakers to stake their tokens and begin earning rewards. The problem arises when there is a delay (Y) between the execution of notifyRewardAmount() and the first call to stake() in a new reward period. Here’s a step-by-step explanation: Step 1: At block timestamp X, notifyRewardAmount() is called, initiating a new reward period intended to last for 2,592,000 seconds (one month). Step 2: There is a delay of Y seconds before the first stake() call is made. For example, if Y is 1,800 seconds (30 minutes), then no tokens are staked to earn rewards during these 1,800 seconds. Step 3: Because the reward distribution is set to end at X + 2,592,000 seconds (the end of the month from the start time), the rewards that would have been distributed during the initial 1,800 seconds (when no tokens were staked) remain undistributed and are essentially locked in the contract until the next reward period begins. Consequences This delay results in: Underutilization of Rewards: The 1,800 tokens that could have been distributed during the initial delay remain unused. This means less overall distribution of rewards during the period, which is inefficient. Locked Rewards: These undistributed rewards are locked in the contract and do not benefit any stakers. They only become relevant or usable in the next reward cycle, which could potentially lead to discrepancies in reward expectations and planning for stakers.
Zokyo Auditing Tutorials | Zokyo Auditing Tutorials
Auditing resources and good categorization.
Cross-Site POST Requests Without a Content-Type Header / nastystereo.com
atiselsts/uniswap-v3-liquidity-math: Code examples for the technical note "Liquidity Math in Uniswap v3"
Code examples for the technical note "Liquidity Math in Uniswap v3" - atiselsts/uniswap-v3-liquidity-math
Collateral Risk Assessment - Kelp DAO Restaked ETH (rsETH) - Llama Risk
DeFi Risk Specialists: Building Trust, Transparency, and Growth in Decentralized Finance
Hickup’s ZK Journey
A new tool that blends your everyday work apps into one. It's the all-in-one workspace for you and your team
SolanaNatives/Solana-Programming-Resources: A complete collection of all the Solana programming resources available for developers.
A complete collection of all the Solana programming resources available for developers. - SolanaNatives/Solana-Programming-Resources
If you are doing an audit of DeFi protocol (CDP/Lending, LSD, AMM):
You should read these articles 👇
👉 Typical vulnerabilities in lending and CDP protocols:
🔗
👉 Typical vulnerabilities in LSD protocols:
🔗
👉 Typical…
— Shieldify Security (@ShieldifySec)
Georgy Kobakhize - Dangerous Decimals: how rounding issues haunt DeFi
We will explore the recent onslaught of rounding issue exploits haunting the world of DeFi. From relatively smal and unknown Compound v2 fork exploits to Bal...
33Audits on X: "If you're a Smart Contract Auditor, then you're probably aware of the $2.35 Million dollar contest that @Uniswap @UniswapFND is having on @cantinaxyz next week. However, not many people are sharing how to prepare for the audit. If you're planning on joining the audit next" / X
However, not many people are sharing how to prepare for the audit.
If you're planning on joining the audit next…
— 33Audits (@solidityauditor)
Dynamic Fees | Uniswap v4 by Example | 0.8.20
learn uniswap v4
Rust smart contract security guide in Solana
Preface In the current blockchain ecosystem, Solana is […]
Lilyjjo/mev_reading_list: List of resources to understand what 'mev' is.
List of resources to understand what 'mev' is. . Contribute to Lilyjjo/mev_reading_list development by creating an account on GitHub.
jeffchen006/OpenTracer: An Ethereum Dynamic Analyzer, a.k.a, open-sourced transaction explorer similar to Phalcon/EthTx/TxTracer
tracer
agiletechvn/go-ethereum-code-analysis: English version
English version. Contribute to agiletechvn/go-ethereum-code-analysis development by creating an account on GitHub.
0xJuancito/multichain-auditor: Observations and tips checklist for auditing protocols on multiple chains 🧐
Observations and tips checklist for auditing protocols on multiple chains 🧐 - 0xJuancito/multichain-auditor
WTF-zk/02_Prime at main · WTFAcademy/WTF-zk
零知识证明入门教程。Comprehensive Zero-Knowledge Proofs Tutorial. #zk #WIP - WTFAcademy/WTF-zk
flashbots/pm: Everything there is to know about Flashbots
Everything there is to know about Flashbots. Contribute to flashbots/pm development by creating an account on GitHub.
A Hitchhiker's Guide to Solana Program Security
solana
0xNazgul/Blockchain-Security-Library: A library of blockchain security resources for various categories in blockchain.
A library of blockchain security resources for various categories in blockchain. - 0xNazgul/Blockchain-Security-Library
Sooper
explanation of protocols
0xDanki
Blockchain Developer, Security and DeFi Nerd, a Friendly Donkey
Synthetix Staking Rewards Issue - Inefficient Reward Distribution
Zhuo Zhang | Purdue CS | Offside Labs on X: "1/7 📷 Attention Web3 hackers and developers! Ever hit a snag with a (forked) on-chain contract revert while working on PoC for bug bounties, or found yourself puzzled by complex contracts like Uniswap v3? Check out what we're showcasing in the video! https://t.co/pL0KFG3KXv" / X
1/7 📷 Attention Web3 hackers and developers! Ever hit a snag with a (forked) on-chain contract revert while working on PoC for bug bounties, or found yourself puzzled by complex contracts like Uniswap v3? Check out what we're showcasing in the video!https://t.co/pL0KFG3KXv— Zhuo Zhang | Purdue CS | Offside Labs (@i2huer) April 3, 2024
Security Incidents
This list documents exploit with associated amounts exceeding $100K.
MiloTruck/audit-notes: A random compilation of notes for auditing
A random compilation of notes for auditing. Contribute to MiloTruck/audit-notes development by creating an account on GitHub.
minaminao/ctf-blockchain: A summary of 100+ CTF blockchain challenges
A summary of 100+ CTF blockchain challenges. Contribute to minaminao/ctf-blockchain development by creating an account on GitHub.
TWAP Oracles For Auditors
What is a TWAP?
A TWAP oracle is a Time-weighted average price oracle that calculates the average price of an asset over some predetermined period of time. If a user wants to know the price of ETH over 28 days then the TWAP will return the average pr...
Cracks in the Code: Understanding the Vulnerabilities of AMM Pro… — millie
Introduction — EVM from Scratch
EVM Opcodes & Solidity Gas Mastery Tutorial | Cyfrin Updraft Assembly & Formal Verification Excerpt
This is an excerpt from the upcoming Assembly, Opcodes, and Formal Verification course. We go over the following in this video:
- How to write a smart contract in Opcodes (with Huff!)
- How to disassemble a smart contract
- How to read the bytecode of a smart contact (without it even being verified on Etherscan!)
- How to write Yul/Inline assembly in Solidity
- How to truly become a gas optimization professional using low-level programming languages
- How the Opcodes in the EVM work
GitHub repo associated with this video: https://github.com/Cyfrin/1-horse-store-s23
GitHub Repo for the coming course: https://github.com/Cyfrin/assembly-evm-opcodes-and-formal-verification-course
Security Course on Updraft: https://updraft.cyfrin.io/courses/security
Register for Cyfrin Updraft: https://updraft.cyfrin.io/
⏰ Timestamps ⏰
0:00:00 | Introduction
0:02:57 | Horse Store - Huff & Opcodes
2:07:39 | Breaking down solidity compiled opcodes
3:24:47 | Yul
3:48:40 | HorseStoreV2 - Huff
4:28:30 | Gas Comparisons & Summary
😸😸Follow Patrick!😸😸
Cyfrin: https://www.cyfrin.io/
YouTube: https://www.youtube.com/@PatrickAlphaC/videos
Twitter: https://twitter.com/patrickalphac
Medium: https://medium.com/@patrickalphac
TikTok: https://www.tiktok.com/@patrickalphac
🛡️ More Cyfrin
CodeHawks: https://codehawks.com/
Solodit: https://solodit.xyz/
Updraft: https://updraft.cyfrin.io/
All thoughts and opinions are my own.