Description

When cross-chain calls occur between VotingEscrowAnzenMainchain and VotingEscrowAnzenSidechain, there is no guarantee that the order of multiple cross-chain calls occurring within the same block.timestamp will be preserved. The data being synchronized between these contracts includes totalSupply and the user’s positionData.

For instance, if three cross-chain calls are made from VotingEscrowAnzenMainchain that update a user’s LockedAmount in positionData from 5 → 10 → 15, the corresponding updates on VotingEscrowAnzenSidechain may not occur in the same order. This could result in incorrect synchronization, such as 5 → 15 → 10, leading to inconsistencies in the data.

Impact

This issue can cause temporary inconsistencies between chains in the user’s LockedAmount and totalSupply. It can disrupt user expectations and introduce inaccuracies in cross-chain operations.

Recommendations

To ensure the correct ordering of updates, replace the reliance on block.timestamp (msgTime) for ordering cross-chain calls with an incrementing index counter. This counter should increase by one with each execution and be included in the data sent from VotingEscrowAnzenMainchain to VotingEscrowAnzenSidechain. By implementing an explicit sequence mechanism, the cross-chain synchronization will maintain the correct order of operations.

Remediation

Anzen Labs Inc. provided the following response:

we acknowledge this issue and will keep the code. (user can call update again to refresh their balance)