# User can avoid paying high premium price by correctly timing his bond call

Dopex bond premium uses time-to-expiry from block.timestamp, so bonding just after a funding epoch resets pays the 0.05% minimum premium instead of the full price.

- Payout: Contest reward
- Severity: medium
- Program: Dopex
- Credited: said
- Disclosed: 2023-12-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/761
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** RdpxV2Core bond / PerpetualAtlanticVault option pricing
**Root cause:** calculateBondCost computes timeToExpiry as nextFundingPaymentTimestamp() - block.timestamp, so the Black-Scholes premium shrinks as the epoch progresses and hits the minimum price floor shortly after each funding update.
**Steps:**
1. Call `calculateBondCost(1e18, 0)` and read `timeToExpiry = nextFundingPaymentTimestamp() - block.timestamp` (604800 at epoch start).
2. Compute `optionPricingSimple.getOptionPrice(strike, currentPrice, 100, timeToExpiry)` -> 16481.
3. `vm.warp(block.timestamp + 1 days)`; recompute timeToExpiry (518400) and option price -> 10000 (0.05% floor).
4. Observe premium is at minimum after only 1 day, so bonding late in the epoch pays far less than bonding at epoch start.
**How found:** Reading calculateBondCost and noticing timeToExpiry derives from block.timestamp rather than a fixed epoch duration, then testing option pricing at 7/6/1 days before next funding to confirm the premium collapses to the floor.
**Exploitation:** User waits until shortly after a funding payment updates the timestamp pointer, then calls bond/bondWithDelegate; wethRequired includes only the minimum premium (0.05%) despite receiving the same option protection, avoiding the high premium paid at epoch start.
**Insight:** When option/premium pricing derives time-to-expiry from a mutable timestamp pointer, check whether the value resets per epoch; pricing near the reset can hit the minimum-price floor and let users systematically underpay.