# Change of fundingDuration causes "time travel" of PerpetualAtlanticVault.nextFundingPaymentTimestamp()

Changing fundingDuration rescales nextFundingPaymentTimestamp by latestFundingPaymentPointer, causing epoch time-travel, skipped epochs, and overpriced option premiums in Dopex perp vault.

- Payout: Contest reward
- Severity: medium
- Program: Dopex
- Credited: 0xTheC0der
- Disclosed: 2023-12-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/850
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-10
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** PerpetualAtlanticVault / RdpxV2Core bonding
**Root cause:** nextFundingPaymentTimestamp() computes genesis + latestFundingPaymentPointer * fundingDuration, so mutating fundingDuration retroactively shifts all epoch boundaries by pointer*delta instead of only affecting future epochs.
**Steps:**
1. Deploy vault, advance 96 epochs via skip(fundingDuration*95) and purchaseOneOption() so latestFundingPaymentPointer=96.
2. Owner calls updateFundingDuration(fundingDuration - 1 hours).
3. skip(fundingDuration) then call updateFundingPaymentPointer(); pointer jumps to 97 but 4 epochs are silently skipped (time travel into past).
4. Alternatively increase fundingDuration by 1 hour: nextFundingPaymentTimestamp lies ~4 days in future, epoch overly long.
5. Call vault.purchase(500 ether, address(this)) during extended epoch; premium computed from inflated timeTillExpiry, overpaying WETH.
**How found:** Code reading of nextFundingPaymentTimestamp() revealed linear scaling with mutable fundingDuration; noted latestFundingPaymentPointer is monotonically increasing, so any delta multiplies by pointer count, producing large time shifts.
**Exploitation:** Owner-triggered fundingDuration change (intended feature) shifts epoch boundaries; users bonding via RdpxV2Core.bond/bondWithDelegate during the extended epoch pay inflated option premiums, draining reserve WETH; users cannot know duration changed between calculateBondCost and their tx.
**Escalation:** Scales with latestFundingPaymentPointer (grows each epoch), so impact worsens over protocol lifetime; affects 14 call sites in vault plus RdpxV2Core.calculateBondCost.
**Insight:** When a timestamp is derived as genesis + counter * mutable_period, any admin change to period retroactively rescales all past epochs; audit accumulator-style time math for pointer*delta drift rather than assuming only future epochs shift.