Submitted by shw
The function foreclosureTimeUser of RCTreasury underestimates the users foreclosure time if the current time is not the users last rent calculation time. The underestimation of the foreclosure time could cause wrong results when determining the new owner of the card.
The variable timeLeftOfDeposit at line 668 is calculated based on depositAbleToWithdraw(_user), the users deposit minus the rent from the last rent calculation to the current time. Thus, the variable timeLeftOfDeposit indicates the time left of deposit, starting from now. However, at line 672, the foreclosureTimeWithoutNewCard is calculated by timeLeftOfDeposit plus the users last rent calculation time instead of the current time. As a result, the users foreclosure time is reduced. From another perspective, the rent between the last rent calculation time and the current time is counted twice.
Recommend changing depositAbleToWithdraw(_user) at line 669 to user[_user].deposit. Or, change user[_user].lastRentCalc at both line 672 and 678 to block.timestamp.
Splidge (Reality Cards) confirmed and resolved:
