Submitted by Kaysoft
https://github.com/code-423n4/2024-07-loopfi/blob/4f508781a49ffa53511e7e5ed6cda0ff0eb5bdc5/src/vendor/AuraVault.sol#L66
https://github.com/code-423n4/2024-07-loopfi/blob/main/src/vendor/AuraVault.sol#L301-L307
AURA rewards will be distributed at a lesser time than a year. In fact, if the AuraVault.sol contract is deployed 295 days after the completion of this audit, No aura rewards will be distributed. This is because the INFLATION_PROTECTION_TIME is hardcoded to 1749120350.
The Aura rewards is to be distributed within a year which is specified with the INFLATION_PROTECTION_TIME constant. However, the INFLATION_PROTECTION_TIME constant is hardcoded in the AuraVault.sol contract to 1749120350.
And there is a validation check to distribute reward only before this 1749120350 timestamp. At the time of writing this report, there are 310 days left and after the audit there will be less than 295 days left for Aura distribution, based on the hardcoded 1749120350 INFLATION_PROTECTION_TIME constant.
If this AuraVault.sol is deployed 295 days from the time of writing this report, no AURA rewards will be distributed.
The issue lies in the fact that INFLATION_PROTECTION_TIME constant is hardcoded to 1749120350, which is already decreasing the duration of rewards from a year to zero.
Consider setting the INFLATION_PROTECTION_TIME in the constructor instead of hardcoding it.
Timing
amarcu (LoopFi) acknowledged and commented:
