# lastUpdatedDay not initialized

Uninitialized lastUpdatedDay in Marginswap IncentiveDistribution makes updateDayTotals loop ~18721 times, causing out-of-gas and breaking all incentive distribution.

- Payout: Audit contest
- Severity: high
- Program: Marginswap
- Disclosed: 2021-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-marginswap-findings/issues/14
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-marginswap%3AH-09
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** IncentiveDistribution.sol staking/incentive contract
**Root cause:** lastUpdatedDay defaults to 0 instead of being set to block.timestamp/(1 days), so dayDiff equals the full number of days since epoch.
**Steps:**
1. Observe `uint256 lastUpdatedDay;` declared with no initializer, defaulting to 0.
2. Call `updateDayTotals()`; it computes `nowDay = block.timestamp / (1 days)` (~18721).
3. `dayDiff = nowDay - lastUpdatedDay` = 18721, driving `for (uint256 i = 0; i < dayDiff; i++)` through ~18721 iterations.
4. Loop exhausts gas, reverting the transaction; updateDayTotals cannot complete.
**How found:** Code review of IncentiveDistribution.sol noticing lastUpdatedDay declared without an initializer and tracing its use as the loop bound in updateDayTotals.
**Exploitation:** Any caller of updateDayTotals triggers the oversized loop; the transaction reverts out-of-gas, permanently blocking incentive distribution. If the loop were to complete, currentDailyDistribution would be overwritten repeatedly and be inaccurate, yielding far lower incentives than expected.
**Insight:** When a loop bound is derived from a stored timestamp/day counter, check that the counter is initialized at deployment; an uninitialized value makes the delta span from epoch and DoSes the function.