feat(REP-0024): implement logic and unit-tests by TuDo1403 · Pull Request #166 · ronin-chain/dpos-contract

TuDo1403 · 2025-05-27T06:51:05Z

This pull request introduces significant updates to the StakingVesting contract and its related interface to enhance flexibility and remove deprecated functionality. Key changes include replacing static bonus configurations with dynamic block rewards, adding new error types and events for better validation and tracking, and deprecating REP-10-related logic.

Spec: https://github.com/ronin-chain/REPs/blob/main/REP-0024/REP-0024.md

Enhancements to Block Rewards and Validation

Introduced a Reward struct and replaced static bonus configurations with dynamic block rewards managed through new methods (updateBlockRewards, setBlockRewardRange, etc.) in IStakingVesting and StakingVesting. These methods enforce validation rules such as bounds checking and descending order of start blocks. [1] [2] [3]
Added new errors (ErrOutOfBound, ErrOutOfOrder, ErrEmptyArray) and the BlockRewardRangeUpdated event to improve input validation and tracking of reward updates. [1] [2]

Deprecation of Unused Functionality

Deprecated REP-10-related logic and fields, including REP10FastFinalityRewardActivated and associated storage variables, to streamline the contract. [1] [2] [3]
Removed bridge operator bonuses and associated methods/events (bridgeOperatorBlockBonus, setBridgeOperatorBonusPerBlock, etc.), as they are no longer used. [1] [2] [3]

Interface and Method Updates

Updated blockProducerBlockBonus to return a uint64 and calculate the bonus dynamically based on the current block number and configured rewards. [1] [2]
Added methods to retrieve the block reward range (getBlockRewardRange) and current block rewards (getBlockRewards) for better transparency. [1] [2]

Internal Contract Refactoring

Introduced _setBlockRewardRange and _updateBlockRewards internal methods in StakingVesting to encapsulate reward-related logic and enforce validation.
Deprecated unused internal variables (_blockProducerBonusPerBlock, _bridgeOperatorBonusPerBlock, etc.) to clean up the contract.

Test and Script Adjustments

Updated tests and scripts to align with the new dynamic reward configuration, replacing calls to deprecated methods with the new updateBlockRewards method. [1] [2]

…-0024

…/rep-0024 chore(`rep-0024`): merge from `release/v0.8.2`

github-actions · 2025-06-13T06:51:13Z

Slither report

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results.
Summary

reentrancy-eth (6 results) (High)
shadowing-state (4 results) (High)
uninitialized-state (12 results) (High)

reentrancy-eth

Impact: High
Confidence: Medium

ID-0
Reentrancy in CoinbaseExecution.wrapUpEpoch():
External calls:

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 102 to 162 in 9b257d0

    
           function wrapUpEpoch() external payable virtual override onlyCoinbase whenEpochEnding oncePerEpoch { 
        
             unchecked { 
        
               uint256 newPeriod = _computePeriod(block.timestamp); 
        
               bool periodEnding = _isPeriodEnding(newPeriod); 
        
               uint256 lastPeriod = currentPeriod(); 
        
               uint256 epoch = epochOf(block.number); 
        
               uint256 nextEpoch = epoch + 1; 
        
               IRandomBeacon randomBeacon = IRandomBeacon(getContract(ContractType.RANDOM_BEACON)); 
        
               // This request is actually only invoked at the first epoch of the period. 
        
               randomBeacon.execRequestRandomSeedForNextPeriod(lastPeriod, newPeriod); 
        
               // Get all candidate ids 
        
               address[] memory allCids = _candidateIds; 
        
               _syncFastFinalityReward({ epoch: epoch, validatorIds: allCids }); 
        
               if (periodEnding) { 
        
                 ISlashIndicator slashIndicatorContract = ISlashIndicator(getContract(ContractType.SLASH_INDICATOR)); 
        
                 // Slash submit random beacon proof unavailability first, then update credit scores. 
        
                 randomBeacon.execRecordAndSlashUnavailability(lastPeriod, newPeriod, address(slashIndicatorContract), allCids); 
        
                 slashIndicatorContract.execUpdateCreditScores(allCids, lastPeriod); 
        
                 (uint256[] memory delegatorBlockMiningRewards, uint256[] memory delegatorFastFinalityRewards) = 
        
                   _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(lastPeriod, allCids); 
        
                 _settleAndTransferDelegatingRewards( 
        
                   lastPeriod, allCids, delegatorBlockMiningRewards, delegatorFastFinalityRewards 
        
                 ); 
        
                 _tryRecycleLockedFundsFromEmergencyExits(); 
        
                 _recycleDeprecatedRewards(); 
        
                 address[] memory revokedCandidateIds = _syncCandidateSet(newPeriod); 
        
                 if (revokedCandidateIds.length > 0) { 
        
                   // Re-update `allCids` after unsatisfied candidates get removed. 
        
                   allCids = _candidateIds; 
        
                   slashIndicatorContract.execResetCreditScores(revokedCandidateIds); 
        
                 } 
        
                 // Wrap up the beacon period includes (1) finalizing the beacon proof, and (2) determining the validator list for the next period by new proof. 
        
                 // Should wrap up the beacon after unsatisfied candidates get removed. 
        
                 randomBeacon.execFinalizeBeaconAndPendingCids(lastPeriod, newPeriod, allCids); 
        
                 _periodEndBlock[lastPeriod] = block.number; 
        
                 _currentPeriodStartAtBlock = block.number + 1; 
        
               } 
        
               // Clear the previous validator set and block producer set before sync the new set from beacon. 
        
               _clearPreviousValidatorSetAndBlockProducerSet(); 
        
               // Query the new validator set for upcoming epoch from the random beacon contract. 
        
               // Save new set into the contract storage. 
        
               address[] memory newValidatorIds = _syncValidatorSet(randomBeacon, newPeriod, nextEpoch); 
        
               // Activate applicable validators into the block producer set. 
        
               _updateApplicableValidatorToBlockProducerSet(newPeriod, nextEpoch, newValidatorIds); 
        
               emit WrappedUpEpoch(lastPeriod, epoch, periodEnding); 
        
               _periodOf[nextEpoch] = newPeriod; 
        
               _lastUpdatedPeriod = newPeriod; 
        
             } 
        
           }

ID-1
Reentrancy in CandidateStaking.execDeprecatePools(address[],uint256):
External calls:

dpos-contract/src/ronin/staking/CandidateStaking.sol

Lines 120 to 155 in 9b257d0

    
           function execDeprecatePools( 
        
             address[] calldata poolIds, 
        
             uint256 newPeriod 
        
           ) external override onlyContract(ContractType.VALIDATOR) { 
        
             if (poolIds.length == 0) { 
        
               return; 
        
             } 
        
             for (uint256 i = 0; i < poolIds.length;) { 
        
               address poolId = poolIds[i]; 
        
               PoolDetail storage _pool = _poolDetail[poolId]; 
        
               // Deactivate the pool admin in the active mapping. 
        
               delete _adminOfActivePoolMapping[_pool.__shadowedPoolAdmin]; 
        
               // Deduct and transfer the self staking amount to the pool admin. 
        
               uint256 deductingAmount = _pool.stakingAmount; 
        
               if (deductingAmount > 0) { 
        
                 _deductStakingAmount(_pool, deductingAmount); 
        
                 if (!_unsafeSendRONLimitGas(payable(_pool.__shadowedPoolAdmin), deductingAmount, DEFAULT_ADDITION_GAS)) { 
        
                   emit StakingAmountTransferFailed(_pool.pid, _pool.__shadowedPoolAdmin, deductingAmount, address(this).balance); 
        
                 } 
        
               } 
        
               // Settle the unclaimed reward and transfer to the pool admin. 
        
               uint256 lastRewardAmount = _claimReward(poolId, _pool.__shadowedPoolAdmin, newPeriod); 
        
               if (lastRewardAmount > 0) { 
        
                 _unsafeSendRONLimitGas(payable(_pool.__shadowedPoolAdmin), lastRewardAmount, DEFAULT_ADDITION_GAS); 
        
               } 
        
               unchecked { 
        
                 ++i; 
        
               } 
        
             } 
        
             emit PoolsDeprecated(poolIds); 
        
           }

ID-2
Reentrancy in CoinbaseExecution.wrapUpEpoch():
External calls:

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 102 to 162 in 9b257d0

    
           function wrapUpEpoch() external payable virtual override onlyCoinbase whenEpochEnding oncePerEpoch { 
        
             unchecked { 
        
               uint256 newPeriod = _computePeriod(block.timestamp); 
        
               bool periodEnding = _isPeriodEnding(newPeriod); 
        
               uint256 lastPeriod = currentPeriod(); 
        
               uint256 epoch = epochOf(block.number); 
        
               uint256 nextEpoch = epoch + 1; 
        
               IRandomBeacon randomBeacon = IRandomBeacon(getContract(ContractType.RANDOM_BEACON)); 
        
               // This request is actually only invoked at the first epoch of the period. 
        
               randomBeacon.execRequestRandomSeedForNextPeriod(lastPeriod, newPeriod); 
        
               // Get all candidate ids 
        
               address[] memory allCids = _candidateIds; 
        
               _syncFastFinalityReward({ epoch: epoch, validatorIds: allCids }); 
        
               if (periodEnding) { 
        
                 ISlashIndicator slashIndicatorContract = ISlashIndicator(getContract(ContractType.SLASH_INDICATOR)); 
        
                 // Slash submit random beacon proof unavailability first, then update credit scores. 
        
                 randomBeacon.execRecordAndSlashUnavailability(lastPeriod, newPeriod, address(slashIndicatorContract), allCids); 
        
                 slashIndicatorContract.execUpdateCreditScores(allCids, lastPeriod); 
        
                 (uint256[] memory delegatorBlockMiningRewards, uint256[] memory delegatorFastFinalityRewards) = 
        
                   _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(lastPeriod, allCids); 
        
                 _settleAndTransferDelegatingRewards( 
        
                   lastPeriod, allCids, delegatorBlockMiningRewards, delegatorFastFinalityRewards 
        
                 ); 
        
                 _tryRecycleLockedFundsFromEmergencyExits(); 
        
                 _recycleDeprecatedRewards(); 
        
                 address[] memory revokedCandidateIds = _syncCandidateSet(newPeriod); 
        
                 if (revokedCandidateIds.length > 0) { 
        
                   // Re-update `allCids` after unsatisfied candidates get removed. 
        
                   allCids = _candidateIds; 
        
                   slashIndicatorContract.execResetCreditScores(revokedCandidateIds); 
        
                 } 
        
                 // Wrap up the beacon period includes (1) finalizing the beacon proof, and (2) determining the validator list for the next period by new proof. 
        
                 // Should wrap up the beacon after unsatisfied candidates get removed. 
        
                 randomBeacon.execFinalizeBeaconAndPendingCids(lastPeriod, newPeriod, allCids); 
        
                 _periodEndBlock[lastPeriod] = block.number; 
        
                 _currentPeriodStartAtBlock = block.number + 1; 
        
               } 
        
               // Clear the previous validator set and block producer set before sync the new set from beacon. 
        
               _clearPreviousValidatorSetAndBlockProducerSet(); 
        
               // Query the new validator set for upcoming epoch from the random beacon contract. 
        
               // Save new set into the contract storage. 
        
               address[] memory newValidatorIds = _syncValidatorSet(randomBeacon, newPeriod, nextEpoch); 
        
               // Activate applicable validators into the block producer set. 
        
               _updateApplicableValidatorToBlockProducerSet(newPeriod, nextEpoch, newValidatorIds); 
        
               emit WrappedUpEpoch(lastPeriod, epoch, periodEnding); 
        
               _periodOf[nextEpoch] = newPeriod; 
        
               _lastUpdatedPeriod = newPeriod; 
        
             } 
        
           }

ID-3
Reentrancy in CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[]):
External calls:
- _distributeMiningReward(vId,treasury)
  - (success,None) = recipient.call{gas: gas,value: amount}()
- _distributeFastFinalityReward(vId,treasury,validatorFFReward)
  - (success,None) = recipient.call{gas: gas,value: amount}()
    State variables written after the call(s):
- delete _delegatorMiningReward[vId]
  CommonStorage._delegatorMiningReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution.submitBlockReward()
- delete _fastFinalityReward[vId]
  CommonStorage._fastFinalityReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution._syncFastFinalityReward(uint256,address[])
- _totalDeprecatedReward += _validatorMiningReward[vId] + _delegatorMiningReward[vId] + _fastFinalityReward[vId]
  CommonStorage._totalDeprecatedReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution._recycleDeprecatedRewards()
- CoinbaseExecution._syncFastFinalityReward(uint256,address[])
- EmergencyExit._tryRecycleLockedFundsFromEmergencyExits()
- CoinbaseExecution.submitBlockReward()
- CommonStorage.totalDeprecatedReward()
- delete _validatorMiningReward[vId]
  CommonStorage._validatorMiningReward can be used in cross function reentrancies:
- CoinbaseExecution._distributeMiningReward(address,address)
- CoinbaseExecution._distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(uint256,address[])
- CoinbaseExecution.submitBlockReward()

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 206 to 244 in 9b257d0

    
           function _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward( 
        
             uint256 lastPeriod, 
        
             address[] memory cids 
        
           ) private returns (uint256[] memory delegatorBlockMiningRewards, uint256[] memory delegatorFastFinalityRewards) { 
        
             address vId; // validator id 
        
             address payable treasury; 
        
             uint256 length = cids.length; 
        
             delegatorBlockMiningRewards = new uint256[](length); 
        
             delegatorFastFinalityRewards = new uint256[](length); 
        
             (uint256 minRate, uint256 maxRate) = IStaking(getContract(ContractType.STAKING)).getCommissionRateRange(); 
        
             for (uint256 i; i < length; ++i) { 
        
               vId = cids[i]; 
        
               treasury = _candidateInfo[vId].__shadowedTreasury; 
        
               if (!_isJailedById(vId) && !_miningRewardDeprecatedById(vId, lastPeriod)) { 
        
                 (uint256 validatorFFReward, uint256 delegatorFFReward) = _calcCommissionReward({ 
        
                   vId: vId, 
        
                   totalReward: _fastFinalityReward[vId], 
        
                   maxCommissionRate: maxRate, 
        
                   minCommissionRate: minRate 
        
                 }); 
        
                 delegatorBlockMiningRewards[i] = _delegatorMiningReward[vId]; 
        
                 delegatorFastFinalityRewards[i] = delegatorFFReward; 
        
                 _distributeMiningReward(vId, treasury); 
        
                 _distributeFastFinalityReward(vId, treasury, validatorFFReward); 
        
               } else { 
        
                 _totalDeprecatedReward += _validatorMiningReward[vId] + _delegatorMiningReward[vId] + _fastFinalityReward[vId]; 
        
               } 
        
               delete _delegatorMiningReward[vId]; 
        
               delete _validatorMiningReward[vId]; 
        
               delete _fastFinalityReward[vId]; 
        
             } 
        
           }

ID-4
Reentrancy in CoinbaseExecution.wrapUpEpoch():
External calls:

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 102 to 162 in 9b257d0

    
           function wrapUpEpoch() external payable virtual override onlyCoinbase whenEpochEnding oncePerEpoch { 
        
             unchecked { 
        
               uint256 newPeriod = _computePeriod(block.timestamp); 
        
               bool periodEnding = _isPeriodEnding(newPeriod); 
        
               uint256 lastPeriod = currentPeriod(); 
        
               uint256 epoch = epochOf(block.number); 
        
               uint256 nextEpoch = epoch + 1; 
        
               IRandomBeacon randomBeacon = IRandomBeacon(getContract(ContractType.RANDOM_BEACON)); 
        
               // This request is actually only invoked at the first epoch of the period. 
        
               randomBeacon.execRequestRandomSeedForNextPeriod(lastPeriod, newPeriod); 
        
               // Get all candidate ids 
        
               address[] memory allCids = _candidateIds; 
        
               _syncFastFinalityReward({ epoch: epoch, validatorIds: allCids }); 
        
               if (periodEnding) { 
        
                 ISlashIndicator slashIndicatorContract = ISlashIndicator(getContract(ContractType.SLASH_INDICATOR)); 
        
                 // Slash submit random beacon proof unavailability first, then update credit scores. 
        
                 randomBeacon.execRecordAndSlashUnavailability(lastPeriod, newPeriod, address(slashIndicatorContract), allCids); 
        
                 slashIndicatorContract.execUpdateCreditScores(allCids, lastPeriod); 
        
                 (uint256[] memory delegatorBlockMiningRewards, uint256[] memory delegatorFastFinalityRewards) = 
        
                   _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(lastPeriod, allCids); 
        
                 _settleAndTransferDelegatingRewards( 
        
                   lastPeriod, allCids, delegatorBlockMiningRewards, delegatorFastFinalityRewards 
        
                 ); 
        
                 _tryRecycleLockedFundsFromEmergencyExits(); 
        
                 _recycleDeprecatedRewards(); 
        
                 address[] memory revokedCandidateIds = _syncCandidateSet(newPeriod); 
        
                 if (revokedCandidateIds.length > 0) { 
        
                   // Re-update `allCids` after unsatisfied candidates get removed. 
        
                   allCids = _candidateIds; 
        
                   slashIndicatorContract.execResetCreditScores(revokedCandidateIds); 
        
                 } 
        
                 // Wrap up the beacon period includes (1) finalizing the beacon proof, and (2) determining the validator list for the next period by new proof. 
        
                 // Should wrap up the beacon after unsatisfied candidates get removed. 
        
                 randomBeacon.execFinalizeBeaconAndPendingCids(lastPeriod, newPeriod, allCids); 
        
                 _periodEndBlock[lastPeriod] = block.number; 
        
                 _currentPeriodStartAtBlock = block.number + 1; 
        
               } 
        
               // Clear the previous validator set and block producer set before sync the new set from beacon. 
        
               _clearPreviousValidatorSetAndBlockProducerSet(); 
        
               // Query the new validator set for upcoming epoch from the random beacon contract. 
        
               // Save new set into the contract storage. 
        
               address[] memory newValidatorIds = _syncValidatorSet(randomBeacon, newPeriod, nextEpoch); 
        
               // Activate applicable validators into the block producer set. 
        
               _updateApplicableValidatorToBlockProducerSet(newPeriod, nextEpoch, newValidatorIds); 
        
               emit WrappedUpEpoch(lastPeriod, epoch, periodEnding); 
        
               _periodOf[nextEpoch] = newPeriod; 
        
               _lastUpdatedPeriod = newPeriod; 
        
             } 
        
           }

ID-5
Reentrancy in CoinbaseExecution.wrapUpEpoch():
External calls:

dpos-contract/src/ronin/validator/CoinbaseExecution.sol

Lines 102 to 162 in 9b257d0

    
           function wrapUpEpoch() external payable virtual override onlyCoinbase whenEpochEnding oncePerEpoch { 
        
             unchecked { 
        
               uint256 newPeriod = _computePeriod(block.timestamp); 
        
               bool periodEnding = _isPeriodEnding(newPeriod); 
        
               uint256 lastPeriod = currentPeriod(); 
        
               uint256 epoch = epochOf(block.number); 
        
               uint256 nextEpoch = epoch + 1; 
        
               IRandomBeacon randomBeacon = IRandomBeacon(getContract(ContractType.RANDOM_BEACON)); 
        
               // This request is actually only invoked at the first epoch of the period. 
        
               randomBeacon.execRequestRandomSeedForNextPeriod(lastPeriod, newPeriod); 
        
               // Get all candidate ids 
        
               address[] memory allCids = _candidateIds; 
        
               _syncFastFinalityReward({ epoch: epoch, validatorIds: allCids }); 
        
               if (periodEnding) { 
        
                 ISlashIndicator slashIndicatorContract = ISlashIndicator(getContract(ContractType.SLASH_INDICATOR)); 
        
                 // Slash submit random beacon proof unavailability first, then update credit scores. 
        
                 randomBeacon.execRecordAndSlashUnavailability(lastPeriod, newPeriod, address(slashIndicatorContract), allCids); 
        
                 slashIndicatorContract.execUpdateCreditScores(allCids, lastPeriod); 
        
                 (uint256[] memory delegatorBlockMiningRewards, uint256[] memory delegatorFastFinalityRewards) = 
        
                   _distributeRewardToTreasuriesAndCalculateTotalDelegatorsReward(lastPeriod, allCids); 
        
                 _settleAndTransferDelegatingRewards( 
        
                   lastPeriod, allCids, delegatorBlockMiningRewards, delegatorFastFinalityRewards 
        
                 ); 
        
                 _tryRecycleLockedFundsFromEmergencyExits(); 
        
                 _recycleDeprecatedRewards(); 
        
                 address[] memory revokedCandidateIds = _syncCandidateSet(newPeriod); 
        
                 if (revokedCandidateIds.length > 0) { 
        
                   // Re-update `allCids` after unsatisfied candidates get removed. 
        
                   allCids = _candidateIds; 
        
                   slashIndicatorContract.execResetCreditScores(revokedCandidateIds); 
        
                 } 
        
                 // Wrap up the beacon period includes (1) finalizing the beacon proof, and (2) determining the validator list for the next period by new proof. 
        
                 // Should wrap up the beacon after unsatisfied candidates get removed. 
        
                 randomBeacon.execFinalizeBeaconAndPendingCids(lastPeriod, newPeriod, allCids); 
        
                 _periodEndBlock[lastPeriod] = block.number; 
        
                 _currentPeriodStartAtBlock = block.number + 1; 
        
               } 
        
               // Clear the previous validator set and block producer set before sync the new set from beacon. 
        
               _clearPreviousValidatorSetAndBlockProducerSet(); 
        
               // Query the new validator set for upcoming epoch from the random beacon contract. 
        
               // Save new set into the contract storage. 
        
               address[] memory newValidatorIds = _syncValidatorSet(randomBeacon, newPeriod, nextEpoch); 
        
               // Activate applicable validators into the block producer set. 
        
               _updateApplicableValidatorToBlockProducerSet(newPeriod, nextEpoch, newValidatorIds); 
        
               emit WrappedUpEpoch(lastPeriod, epoch, periodEnding); 
        
               _periodOf[nextEpoch] = newPeriod; 
        
               _lastUpdatedPeriod = newPeriod; 
        
             } 
        
           }

shadowing-state

Impact: High
Confidence: High

ID-6
CandidateStaking.______gap shadows:
- BaseStaking.______gap
- RewardCalculation.______gap

dpos-contract/src/ronin/staking/CandidateStaking.sol

Line 27 in 9b257d0

uint256[48] ______gap;

ID-7
BaseStaking.______gap shadows:
- RewardCalculation.______gap

dpos-contract/src/ronin/staking/BaseStaking.sol

Line 40 in 9b257d0

uint256[49] private ______gap;

ID-8
CommonStorage.______gap shadows:

dpos-contract/src/ronin/validator/storage-fragments/CommonStorage.sol

Line 39 in 9b257d0

uint256[44] private ______gap;

ID-9
DelegatorStaking.______gap shadows:
- BaseStaking.______gap
- RewardCalculation.______gap

dpos-contract/src/ronin/staking/DelegatorStaking.sol

Line 13 in 9b257d0

uint256[50] private ______gap;

uninitialized-state

Impact: High
Confidence: High

ID-10
TimingStorage._firstTrackedPeriodEnd is never initialized. It is used in:
- TimingStorage.getPeriodEndBlock(uint256)

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 23 in 9b257d0

uint256 internal _firstTrackedPeriodEnd;

ID-11
TimingStorage._numberOfBlocksInEpoch is never initialized. It is used in:

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 10 in 9b257d0

uint256 internal _numberOfBlocksInEpoch;

ID-12
TimingStorage._periodOf is never initialized. It is used in:
- TimingStorage.tryGetPeriodOfEpoch(uint256)

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 19 in 9b257d0

mapping(uint256 epoch => uint256 period) internal _periodOf;

ID-13
JailingStorage._miningRewardDeprecatedAtPeriod is never initialized. It is used in:
- JailingStorage._miningRewardDeprecatedById(address,uint256)

dpos-contract/src/ronin/validator/storage-fragments/JailingStorage.sol

Line 9 in 9b257d0

    
           mapping(address => mapping(uint256 => bool)) internal _miningRewardDeprecatedAtPeriod;

ID-14
TimingStorage._lastUpdatedBlock is never initialized. It is used in:
- TimingStorage.getLastUpdatedBlock()

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 12 in 9b257d0

uint256 internal _lastUpdatedBlock;

ID-15
ValidatorInfoStorageV2._validatorCount is never initialized. It is used in:

dpos-contract/src/ronin/validator/storage-fragments/ValidatorInfoStorageV2.sol

Line 18 in 9b257d0

uint256 internal _validatorCount;

ID-16
TimingStorage._lastUpdatedPeriod is never initialized. It is used in:

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 14 in 9b257d0

uint256 internal _lastUpdatedPeriod;

ID-17
JailingStorage._blockProducerJailedBlock is never initialized. It is used in:
- JailingStorage._getJailedTimeLeftAtBlockById(address,uint256)
- JailingStorage._isJailedAtBlockById(address,uint256)

dpos-contract/src/ronin/validator/storage-fragments/JailingStorage.sol

Line 16 in 9b257d0

mapping(address => uint256) internal _blockProducerJailedBlock;

ID-18
ValidatorInfoStorageV2._validatorMap is never initialized. It is used in:
- ValidatorInfoStorageV2._isBlockProducerById(address)

dpos-contract/src/ronin/validator/storage-fragments/ValidatorInfoStorageV2.sol

Line 22 in 9b257d0

mapping(address cid => bool isBlockProducer) internal _validatorMap;

ID-19
TimingStorage._periodEndBlock is never initialized. It is used in:
- TimingStorage.getPeriodEndBlock(uint256)

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 21 in 9b257d0

mapping(uint256 period => uint256 endedAtBlock) internal _periodEndBlock;

ID-20
ValidatorInfoStorageV2._validatorIds is never initialized. It is used in:

dpos-contract/src/ronin/validator/storage-fragments/ValidatorInfoStorageV2.sol

Line 20 in 9b257d0

mapping(uint256 idx => address cid) internal _validatorIds;

ID-21
TimingStorage._currentPeriodStartAtBlock is never initialized. It is used in:
- TimingStorage.currentPeriodStartAtBlock()

dpos-contract/src/ronin/validator/storage-fragments/TimingStorage.sol

Line 16 in 9b257d0

uint256 internal _currentPeriodStartAtBlock;

huyhuynh3103

Do you have the storage layout log?

huyhuynh3103 · 2025-06-17T10:50:55Z

src/interfaces/IStakingVesting.sol

+  error ErrEmptyArray();
+
+  struct Reward {
+    uint64 startBlock;


Using uint64 for block numbers is quite risky, since we have a plan to update the block time to 1 second

huyhuynh3103 · 2025-06-17T10:51:39Z

src/ronin/StakingVesting.sol

  /// @dev The boolean flag to check if REP-10 is activated.
-  bool internal _isREP10Activated;
+  bool internal __deprecatedIsREP10Activated;
+  Reward[] internal _blockRewards;


Add comments

huyhuynh3103 · 2025-06-17T10:59:39Z

src/ronin/StakingVesting.sol

+  ) internal {
+    uint256 length = rewards.length;
+    if (length == 0) revert ErrEmptyArray();
+    delete _blockRewards;


This just sets the array length to zero and leaves the values at each index untouched, right? Is that expected?

no that actually delete the block reward array imo

huyhuynh3103 · 2025-06-17T11:02:06Z

src/ronin/StakingVesting.sol

+  /**
+   * @inheritdoc IStakingVesting
+   */
+  function receiveRON() external payable { }


This logic is not mentioned in REP

this is untouched.

huyhuynh3103 · 2025-06-17T11:02:57Z

src/ronin/StakingVesting.sol

    _lastBlockSendingBonus = block.number;

    blockProducerBonus = forBlockProducer ? blockProducerBlockBonus(block.number) : 0;
-    bridgeOperatorBonus = forBridgeOperator ? bridgeOperatorBlockBonus(block.number) : 0;


This logic also is not mentioned in REP#24

deprecated long ago

Tu Do added 5 commits May 27, 2025 13:49

feat\(REP-0024\): implement logic

c01e5dd

Merge branch 'feature/rep-0024' into merge/release/v0.8.2-feature/rep…

c3f9043

…-0024

style(automated): post-commit forge fmt (*.sol)

962b326

chore(automated): post-commit update .git-blame-ignore-revs

6bc0489

Merge pull request #167 from ronin-chain/merge/release/v0.8.2-feature…

235422a

…/rep-0024 chore(`rep-0024`): merge from `release/v0.8.2`

TuDo1403 changed the base branch from mainnet to release/v0.8.2 June 13, 2025 07:08

TuDo1403 added 5 commits June 13, 2025 14:55

test: add unit tests and fork tests and remove unused function

b9e2528

style(automated): post-commit forge fmt (*.sol)

8bce2a8

chore(automated): post-commit update .git-blame-ignore-revs

c63c26b

chore: remove lib

e0f4761

chore: use ubuntu-latest for deploy doc

94a2563

TuDo1403 changed the title ~~feat(REP-0024): implement logic~~ feat(REP-0024): implement logic and unit-tests Jun 17, 2025

huyhuynh3103 reviewed Jun 17, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(REP-0024): implement logic and unit-tests#166

feat(REP-0024): implement logic and unit-tests#166
TuDo1403 wants to merge 10 commits intorelease/v0.8.2from
feature/rep-0024

TuDo1403 commented May 27, 2025

Uh oh!

github-actions bot commented Jun 13, 2025 •

edited

Loading

Uh oh!

huyhuynh3103 left a comment

Uh oh!

huyhuynh3103 Jun 17, 2025

Uh oh!

huyhuynh3103 Jun 17, 2025

Uh oh!

huyhuynh3103 Jun 17, 2025

Uh oh!

TuDo1403 Jun 17, 2025

Uh oh!

huyhuynh3103 Jun 17, 2025

Uh oh!

TuDo1403 Jun 17, 2025

Uh oh!

huyhuynh3103 Jun 17, 2025

Uh oh!

TuDo1403 Jun 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

TuDo1403 commented May 27, 2025

Enhancements to Block Rewards and Validation

Deprecation of Unused Functionality

Interface and Method Updates

Internal Contract Refactoring

Test and Script Adjustments

Uh oh!

github-actions bot commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Slither report

reentrancy-eth

shadowing-state

uninitialized-state

Uh oh!

huyhuynh3103 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Jun 13, 2025 •

edited

Loading