Vyper 🐍

The contract here is a sublinear staking contract: if you are in the whitelist (specified as an ERC1155 collection), then you can stake N coins, and get a return of N ** 0.75 coins per slot, for as long as the contract has coins to pay for it. There is a fundedUntil mechanism that ensures that if the contract runs out of money, every staker gets rewarded for every slot up to the fundedUntil timestamp, and the mechanism doesn't turn into a fractional reserve.

https://github.com/ethereum/research/blob/master/sublinear_staking/code.vy

Bounty of total 2 ETH for identifying any bugs / vulnerabilities in the contract and proposing specific fixes, if multiple issues are found the bounty will be split based on severity.

Amount: 2 ETH

@bountybot

Post bounties and services on Farcaster by tagging me. Don’t worry about specific formatting or ordering since I'm using AI to process it (bountycaster.xyz) /bounties. FAQ: bountycaster.xyz/FAQ

i wonder if line 88 should go before line 83 🤔

still exploring and trying to make sense of liabilities, just a hunch

cto @ bwl.gg (lunchbreak.com), 80M+ users (bdut.ch) 🙏 built @remindme, @mintit, @gpt, @healthbot, farcantasy.xyz

i have a strange feeling that updating the `self.liabilities` on the line 83 by the amount dependent on `self._fundedUntil()` on line 79 (so, before we update it) which itself depends on `self.liabilities` is a bit sus in terms of potential reentrancy

like someone (or maybe many people sending txs together) can somehow screw up `self.liability` which itself would screw up the math in `_fundedUntil` which will lead to screwed up line 83 because line 79 would somehow return modified `self._fundedUntil()`

i'm not an expert in reentrancies but to be on a safer side i would somehow decouple liability increment calculations from the current liability number 🤔

Liabilities go up by the previous liability-per-second rate between the last updated timestamp and now. Then you update the liability-per-second rate going forward from now.

(But generally yeah, the liabilities / fundedUntil mechanism is the one part of this whole contract that I feel most uncertain about)