# cvgControlTower and veCVG lock timing will be different and lead to yield loss scenarios

Cycle-based lock accounting in CvgRewards diverges from veCVG's week-rounded unlock math, causing expired locks to be unwithdrawable or unextendable, DoSing users' yield and voting power.

- Payout: Contest reward
- Severity: medium
- Program: Convergence
- Credited: 0x52
- Disclosed: 2023-11-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-11-convergence-judging/issues/178
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-convergence%3AM-4
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** veCVG / LockingPositionService / CvgRewards cycle accounting
**Root cause:** CvgRewards cycles use block.timestamp and require >=7 days between rollovers, so cycle length fluctuates above 604800s, while veCVG rounds unlock time down to absolute weeks; the two lock timelines drift apart.
**Steps:**
1. Observe CvgRewards.sol L345 sets lastUpdateTime via block.timestamp and L205 requires >=7 days to roll cycle, so cycles are never exactly 604800s.
2. Observe veCVG.vy L328 computes unlock as floor((ts + n*604800)/604800)*604800.
3. Example: cycle start 1,000,000, user deposits at 1,400,000 for one cycle; LockingPositionService unlocks at 2,209,600 but veCVG computes 2,419,200.
4. veCVG L404 check blocks withdrawal until veCVG unlock, DoSing the expired lock.
5. Reverse case: cycles average +7200s drift; after 95 cycles user at 58,140,000 tries to extend a 96-week lock but veCVG L367 reverts since veCVG lock ended at 58,060,800.
**How found:** Code-reading comparison of two independent lock accounting mechanisms: noticed CvgRewards cycles are timestamp-driven and non-fixed-length while veCVG rounds to absolute weeks, then constructed numeric examples showing the two unlock timestamps diverge in both directions.
**Insight:** When a protocol maintains two parallel time/lock accounting systems (cycle counters vs absolute week rounding), diff their unlock computations with concrete timestamps; any drift creates permanent DoS windows on withdraw/extend paths.