# ERC20TokenEmitter will not work after a certain period of time

VRGDAC.yToX reverts on large timeSinceStart due to fixed-point precision loss, permanently bricking ERC20TokenEmitter.buyToken after ~400 days.

- Payout: Contest reward
- Severity: medium
- Program: Collective
- Credited: zhaojie
- Disclosed: 2024-02-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-revolutionprotocol-findings/issues/371
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:dos vuln:precision-loss

**Target:** ERC20TokenEmitter / VRGDAC pricing contract
**Root cause:** VRGDAC.yToX fixed-point math underflows to zero in a parameter when timeSinceStart grows large, causing a revert (UNDEFINED) instead of returning a price.
**Steps:**
1. Deploy VRGDAC with params `new VRGDAC(1 ether, 1e18/10, 1000*1e18)`.
2. Call `vrgdac.yToX({timeSinceStart: toDaysWadUnsafe(86400*400), sold: 1000 ether, amount: 1 ether})`.
3. Observe revert with reason UNDEFINED; with 365 days it succeeds.
4. In ERC20TokenEmitter, `buyTokenQuote` passes `timeSinceStart = toDaysWadUnsafe(block.timestamp - startTime)`; after ~400 days this reverts, so `buyToken` always reverts.
**How found:** Researcher tested VRGDAC.yToX with increasing timeSinceStart values and noticed a revert at 400 days but success at 365 days, then traced the call path into ERC20TokenEmitter.buyToken.
**Exploitation:** Not an attack; the flaw causes a permanent denial of service of token purchases once the contract has been live long enough (or supply is far off schedule), because the pricing math reverts.
**Insight:** When integrating fixed-point bonding-curve math, fuzz timeSinceStart and supply far beyond realistic ranges; parameters that decay toward zero can underflow and revert, turning a pricing function into a permanent DoS.