# Flash attack mitigation does not work as intended in USDV.sol

USDV's flashProof modifier relies on uninitialized blockDelay (default 0), so same-block flash-loan attacks bypass the intended flash-attack mitigation entirely.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/138
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:misconfiguration

**Target:** USDV.sol smart contract flashProof modifier / isMature check
**Root cause:** blockDelay state variable is never initialized, defaulting to 0, so isMature()'s check `lastBlock[tx.origin] + blockDelay <= block.number` passes within the same block, allowing multiple calls per transaction.
**Steps:**
1. Read USDV.sol flashProof() modifier calling isMature() with check `lastBlock[tx.origin] + blockDelay <= block.number`.
2. Observe blockDelay is declared but never set in constructor or declaration, defaulting to uint 0.
3. Note setParams() is DAO-only and DAO cannot currently call it, so blockDelay stays 0.
4. Conclude multiple USDV calls can execute in the same block/transaction, enabling flash-loan attacks the modifier was meant to stop.
**How found:** Reviewed the stated protocol goal of resisting flash-loan attacks, traced the flashProof modifier to isMature(), and noticed blockDelay was never initialized and setParams() was unreachable by the DAO.
**Exploitation:** Not demonstrated; the flaw removes the same-block restriction, permitting an attacker to perform multiple USDV operations within one transaction (e.g. via flash loan) that the protocol intended to block.
**Insight:** When a guard depends on a configurable state variable, check its default value and whether the setter is actually reachable; an unset uint defaulting to 0 silently disables time/block-delay protections.