# _checkDelay will not work properly for Arbitrum or Optimism due to block.number 

Tigris Trade's _checkDelay uses block.number, which on Arbitrum/Optimism is stale or per-tx, letting traders bypass the open/close trade delay and reuse one oracle price.

- Payout: Contest reward
- Severity: medium
- Program: Tigris Trade
- Credited: 0x52
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/419
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-15
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** Solidity perpetuals contract _checkDelay trade delay logic
**Root cause:** _checkDelay measures the open/close delay in block.number, but on Arbitrum block.number is the last synced L1 block (stale up to ~1 min) and on Optimism each tx is its own block, so the intended delay is not enforced.
**Steps:**
1. On Arbitrum, open a position 1 L2 block before the sequencer syncs block.number to L1.
2. Close the position in the very next L2 block; block.number jumps ~5 blocks (60/12) making the delay appear satisfied though only ~2s elapsed.
3. On Optimism, pad tiny transactions so each consumes a block, then close immediately.
4. Result: same oracle price usable across open and close, bypassing the trade delay.
**How found:** Code review of _checkDelay's use of block.number combined with reading Arbitrum and Optimism docs on block.number semantics (L1-synced/stale on Arbitrum, per-tx blocks on Optimism).
**Exploitation:** Trader times open/close around the Arbitrum L1 block-number sync (or spams txs on Optimism) to satisfy the block-based delay in ~1-2 seconds, reusing a single oracle price for both legs.
**Insight:** When auditing cross-chain deployments, check every block.number-based timing assumption against L2 semantics: Arbitrum's block.number tracks L1 and is stale between syncs, Optimism increments per transaction, so delays meant to span time must use block.timestamp.