EGP #002 Notifier, Update to Lockup

This post briefly summarizes the Eco Governance Proposal submitted on November 29th, 2022. This proposal patches a bug in the Lockup contract and adds some infrastructure that can be used to ensure Uniswap pools are synced. It can be found here.

Summary

The vulnerability in the lockups occurred when the delegate changes between successive deposits to the same lockup. This would cause the first delegation to be overwritten and cause delegated voting power to break when funds are withdrawn from the lockup. The initial address that was delegated to would have its voting power stolen and its funds in the lockup frozen.
Our patch to this issue was changing the deposit flow to check if any address deposits into the same lockup multiple times. If they do so with a different delegate than the first time, the current locked up balance is first undelegated from the old delegate and redelegated to the new. In this way, all funds locked up for any given address are delegated to the address’ primary delegate at the time of the most recent deposit, and an attacker attempting the same exploit would find themselves with no more Eco or voting power than expected.
Additionally, we made the lockup withdrawal time consistent for all users, rather than having it be dependent on the exact timestamp of deposits.

The notifier is a scaffolding contract that can communicate the generation increment to outside contracts. A clear and present use case is Uniswap pools containing Eco as part of the pair. Specifically, this will help sync the pool and ensure that the pool can stay up to date with the latest changes to linear inflation, as Uniswap’s pricing of the token will need to reflect this. The notifier will call to the pool atomically with the generation increase, removing skimming when the inflation multiplier changes.

9 Likes

just an fyi, the ‘here’ hyperlink is broken

Voted in support, patching should have top priority.

1 Like

Confirmed. Even inspecting the element, and clicking that URL is not functional.

Subspace

Thanks for flagging @Subspace and @Rob!! Fixed the hyperlink :slight_smile:

1 Like

I support and vote, it’s a really important proposal.

Based on clear support for this proposal from the community, the Association will submit support with its full voting power (based on its holdings and delegations to it). We expect this will satisfy the support threshold and kick off the 3-day voting period.

5 Likes

Based on clear support for this proposal from the community, the Association will vote in favor with its full voting power (based on its holdings and delegations to it). We expect this will result in the successful execution of this protocol improvement proposal.

4 Likes

I support the proposal :+1:

2 Likes

This proposal has been passed successfully by the Eco Community and will be implemented by the Eco Protocol in Generation 1004. This post is being closed for comments as it is no longer an active topic.

2 Likes