This post briefly summarizes the Eco Governance Proposal submitted on November 29th, 2022. This proposal patches a bug in the Lockup contract and adds some infrastructure that can be used to ensure Uniswap pools are synced. It can be found here.
Summary
The vulnerability in the lockups occurred when the delegate changes between successive deposits to the same lockup. This would cause the first delegation to be overwritten and cause delegated voting power to break when funds are withdrawn from the lockup. The initial address that was delegated to would have its voting power stolen and its funds in the lockup frozen.
Our patch to this issue was changing the deposit flow to check if any address deposits into the same lockup multiple times. If they do so with a different delegate than the first time, the current locked up balance is first undelegated from the old delegate and redelegated to the new. In this way, all funds locked up for any given address are delegated to the address’ primary delegate at the time of the most recent deposit, and an attacker attempting the same exploit would find themselves with no more Eco or voting power than expected.
Additionally, we made the lockup withdrawal time consistent for all users, rather than having it be dependent on the exact timestamp of deposits.
The notifier is a scaffolding contract that can communicate the generation increment to outside contracts. A clear and present use case is Uniswap pools containing Eco as part of the pair. Specifically, this will help sync the pool and ensure that the pool can stay up to date with the latest changes to linear inflation, as Uniswap’s pricing of the token will need to reflect this. The notifier will call to the pool atomically with the generation increase, removing skimming when the inflation multiplier changes.
