# Block number vs timestamp mismatch

Time arguments crossing function boundaries in the wrong unit, double-added, or anchored to the wrong block

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-07-03. Updated 2026-10-23._

## How it works
Code that reasons about time must pick one clock: block number or block timestamp. The bug is passing a value from one clock where the other is expected, adding a duration to an already-absolute deadline, or anchoring a clock to the wrong block. The receiving function does not validate units, so the wrong value silently resolves to a valid-but-wrong point in time (often before deployment, or far in the future). The broken assumption is that "a time value is a time value"; in practice the two clocks differ by orders of magnitude and boundary semantics differ too. No exploit steps are given here.

## Where it shows up
- Calls into checkpoint-based vote lookups (`getPriorVotes`, `getVotes`, `getPastVotes`) where the argument is `block.number` but the token tracks timestamps, or vice versa [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-olympus-on-chain-governance%3AM-1.md)[E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-16.md).
- Call sites doing `block.timestamp + _timelock` passed into a helper that already adds `block.timestamp` [E2](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.3.md).
- Session or deadline logic anchored to the submitting transaction's block rather than the target block's own time (adjacent clock-anchor bug, not a unit mismatch).
- Forked governance code where the original used one clock and the fork's token uses the other [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-16.md).

## How to review
For every time argument crossing a function boundary, confirm the unit matches the callee's expectation and the boundary rule (strict `<` vs `<=`) matches the deployed implementation [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-olympus-on-chain-governance%3AM-1.md). For timelocks, confirm the deadline is computed exactly once: either the caller passes a relative duration and the helper adds `now`, or the caller passes an absolute deadline and the helper does not [E2](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.3.md). Grep call sites of pending/timelock update helpers for `block.timestamp +` and `block.number` arguments, and trace each into the callee. Invariant: a computed deadline equals `now + intended_delay` exactly, and a vote lookup resolves to a block/timestamp at or before the current one.

## Variants seen
- Block number passed to a timestamp-based vote lookup, bricking all proposals [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-16.md).
- Boundary-semantics mismatch: `block.number` passed where the token requires strictly `< block.number`, so every vote reverts [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-olympus-on-chain-governance%3AM-1.md).
- Double-added timestamp in a timelock, locking a parameter for ~55 years with no revoke [E2](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.3.md).

## Why fixes fail
In E2 no revoke exists and resubmission reverts with `AlreadyPending`, so the bad state is unrecoverable without a contract upgrade; a partial fix that only corrects the call site leaves already-pending entries stuck.

## Impact and severity
Complete denial of governance (no votes, no proposals) [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-olympus-on-chain-governance%3AM-1.md)[E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-16.md) and effectively permanent parameter lock [E2](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.3.md). Severity rises when the broken path is the only entry point and no admin override, revoke, or upgrade path exists.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-01-olympus-on-chain-governance%3AM-1.md
- E2: https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.3.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-16.md