Content
@
0 reply
0 recast
0 reaction
Vitalik Buterin
@vitalik.eth
The contract here is a sublinear staking contract: if you are in the whitelist (specified as an ERC1155 collection), then you can stake N coins, and get a return of N ** 0.75 coins per slot, for as long as the contract has coins to pay for it. There is a fundedUntil mechanism that ensures that if the contract runs out of money, every staker gets rewarded for every slot up to the fundedUntil timestamp, and the mechanism doesn't turn into a fractional reserve. https://github.com/ethereum/research/blob/master/sublinear_staking/code.vy Bounty of total 2 ETH for identifying any bugs / vulnerabilities in the contract and proposing specific fixes, if multiple issues are found the bounty will be split based on severity. Amount: 2 ETH @bountybot
24 replies
202 recasts
908 reactions
borodutch
@warpcastadmin.eth
i wonder if line 88 should go before line 83 🤔 still exploring and trying to make sense of liabilities, just a hunch
1 reply
0 recast
5 reactions
Vitalik Buterin
@vitalik.eth
Liabilities go up by the previous liability-per-second rate between the last updated timestamp and now. Then you update the liability-per-second rate going forward from now. (But generally yeah, the liabilities / fundedUntil mechanism is the one part of this whole contract that I feel most uncertain about)
1 reply
0 recast
5 reactions
borodutch
@warpcastadmin.eth
i have a strange feeling that updating the `self.liabilities` on the line 83 by the amount dependent on `self._fundedUntil()` on line 79 (so, before we update it) which itself depends on `self.liabilities` is a bit sus in terms of potential reentrancy like someone (or maybe many people sending txs together) can somehow screw up `self.liability` which itself would screw up the math in `_fundedUntil` which will lead to screwed up line 83 because line 79 would somehow return modified `self._fundedUntil()` i'm not an expert in reentrancies but to be on a safer side i would somehow decouple liability increment calculations from the current liability number 🤔
1 reply
0 recast
1 reaction
borodutch
@warpcastadmin.eth
`_unstake` does follow the CEI though, unless line 81 is considered an interaction (with its dependencies on lines 78:80), that's probably what triggers my spidey senses, interaction with sending tokens dependent on variables before the effects happen
1 reply
0 recast
0 reaction
borodutch
@warpcastadmin.eth
what i'm saying is that i really want to move line 82 to the beginning of the function, saving the stake amount into a local variable 🥲
1 reply
0 recast
1 reaction
