# Reducing the epoch length results in leaking value from advancement incentives

DAO computes next epoch start from genesis timestamp times current epoch length, so shortening epoch length lets callers repeatedly advance and drain 100 MALT incentives.

- Payout: Audit contest
- Severity: medium
- Program: Malt Finance
- Found by: TomFrench_
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-malt-findings/issues/4
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-13
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** DAO.sol epoch advancement incentive logic
**Root cause:** Next epoch start is computed as genesisTimestamp + epochNumber * currentEpochLength, ignoring that prior epochs used a different length, so reducing epochLength makes many future epochs appear already started.
**Steps:**
1. Read DAO.sol advance() which mints 100 MALT if block.timestamp >= start of next epoch
2. Note next epoch start = genesis + newEpochNumber * epochLength (current value)
3. Admin reduces epochLength via setter (lines 111-114)
4. Call advance() repeatedly; each call sees next epoch start in the past and pays 100 MALT incentive
5. Repeat while incentive > gas cost
**How found:** Code review of the epoch start calculation noticing it derives from genesis timestamp and current epoch length without accounting for historical epoch length changes.
**Exploitation:** After epochLength is reduced, an attacker (or any caller) repeatedly invokes advance(); the timestamp check passes for many successive epoch numbers because the recomputed start times fall in the past, minting 100 MALT per call until incentives no longer exceed gas.
**Insight:** When time-based accounting multiplies a mutable parameter by an index from a fixed origin, check whether changing the parameter retroactively shifts all past checkpoints; look for admin-settable rates feeding timestamp math.