# End epoch cannot be triggered preventing winners to withdraw

triggerEndEpoch reverts while Arbitrum sequencer is down or within 1h grace period, blocking winners from withdrawing and risking a depeg flip.

- Payout: Contest reward
- Severity: high
- Program: Y2k Finance
- Credited: eierina
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-y2k-finance-findings/issues/278
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** Controller.sol triggerEndEpoch / getLatestPrice oracle check
**Root cause:** triggerEndEpoch calls getLatestPrice() only to populate an informational event, but that call reverts on SequencerDown or within GRACE_PERIOD_TIME after restart, so the epoch-end state transition never executes.
**Steps:**
1. Observe triggerEndEpoch emits DepegInsurance with getLatestPrice(insrVault.tokenInsured()) as final arg.
2. getLatestPrice reverts SequencerDown if answer!=0, and GracePeriodNotOver if block.timestamp-startedAt <= GRACE_PERIOD_TIME (1h).
3. During sequencer outage/grace, triggerEndEpoch reverts; idClaimTVL/ifFinalTVL never set.
4. withdraw passes epochHasEnded (timestamp>id) but beforeWithdraw ratio idClaimTVL/ifFinalTVL is zero, so winners get nothing.
**How found:** Code reading of triggerEndEpoch's event emission: noticed getLatestPrice is only used for logging yet its revert conditions gate the whole state transition.
**Escalation:** If strike price is reached during the blocked window, a depeg event can flip winners to losers.
**Insight:** When an oracle/price call is used only for event logging, check whether its revert conditions (sequencer uptime, grace period) can block a critical state transition; informational reads should not gate settlement.