Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIthdraw from Window lacks observability in edge case #572

Open
ckartik opened this issue Jan 17, 2025 · 0 comments
Open

WIthdraw from Window lacks observability in edge case #572

ckartik opened this issue Jan 17, 2025 · 0 comments
Assignees
Labels
good first issue Good for newcomers

Comments

@ckartik
Copy link
Contributor

ckartik commented Jan 17, 2025

function withdrawFromWindows(
        uint256[] calldata windows
    ) external nonReentrant whenNotPaused {
        uint256 currentWindow = blockTrackerContract.getCurrentWindow();
        uint256 totalAmount;

        uint256 len = windows.length;
        for (uint256 i = 0; i < len; ++i) {
            uint256 window = windows[i];
            require(window < currentWindow, WithdrawAfterWindowSettled(window, currentWindow));

            uint256 amount = lockedFunds[msg.sender][window];

            lockedFunds[msg.sender][window] = 0;
            maxBidPerBlock[msg.sender][window] = 0;

            (uint256 startBlock, uint256 endBlock) = WindowFromBlockNumber.getBlockNumbersFromWindow(window);

            for (uint256 blockNumber = startBlock; blockNumber <= endBlock; ++blockNumber) {
                usedFunds[msg.sender][uint64(blockNumber)] = 0;
            }

            emit BidderWithdrawal(msg.sender, window, amount);

            totalAmount += amount;
        }

        (bool success, ) = msg.sender.call{value: totalAmount}("");
        require(success, BidderWithdrawalTransferFailed(msg.sender, totalAmount));
    }

Observe above tha tin the case where the bidder is unable to successfully execute (bool success, ) = msg.sender.call{value: totalAmount}(""); there's no event that corresponds to this, instead from the perspective of events, the bidders withdrawal was successful.

I useful mitigation to this is to move the bidderWithdrawl event to be fired after successful withdrawal of funds.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

1 participant