Submitted by carrotsmuggler, also found by KIntern_NA, deadrxsezzz (1, 2), and GalloDaSballo
A user can lock their LP tokens into the TOLP contract, and then put their TOLP into the TOB contract to be eligible for option rewards. These option rewards are paid out every epoch and distributed proportionally to all the participants in that epoch. When locking LP tokens in TOLP, the user can choose their own _lockDuration.
The TOB contract has 2 important functions. One is the exitPosition, which allows users to take out their TOLP token, and the other is the exerciseOption function, which allows the users to collect the option rewards. The issue is that the TOLP contract records lock duration in seconds, while the TOB contract processes them in epochs.
So if a user creates a lock position where the lock end time is a single second after the epoch change, the epoch when the lock is due to expire in the TOB contract will be calculated as shown.
So if a user lock expires a single second into an epoch, the lastEpoch will be calculated as that epoch and the user will be eligible for that entire epochs rewards.
Moreover, this also allows a peculiar situation where a user can take out their TOLP token and exit their position and then come back and collect their token rewards. This is because when users want to exit their position, the contract checks if the lock has expired.
But when a user wants to exercise their options, the contract checks for the liveness of the position in different terms, the epoch.
The first method and the second method can disagree if a position is active. If the expiry time is in the middle of an epoch, for the entire second half of the epoch, the exitPosition function will treat the position as expired and will allow the user to take out their TOLP token, but the exerciseOption contract will treat the position as active and will allow the user to collect rewards as well. Due to the discussion above, the user can have only a single second of lock time remaining in this second epoch; so for the entire duration of 7 days, the user can have no TOLP locked in the contract but still be eligible to withdraw rewards.
The situation can be created in the following manner:
The different contracts should use the same mechanism to define locks. Either use epochs in both TOLP and TOB contracts, or use seconds in both. The current situation is a bit confusing and can lead to unexpected behavior.
Invalid Validation
0xWeiss (Tapioca) confirmed
