apegurus/stateful-parameter-update-drift

<!-- Source: BailSec audit reports (CC0) -->

Stateful Parameter Update Drift Vulnerabilities

Overview

Protocols with time-based accrual (fees, rebases, emissions, yield drips) often expose governance or admin setters that modify core parameters while accrual windows are still open. If the contract does not settle or checkpoint state before applying the new value, the update retroactively changes historical accounting. This creates hindsight effects: users can gain or lose value for periods that should already be fixed.

The vulnerability is not just governance centralization. Even trusted governance can unintentionally trigger unfair redistribution or lockups when parameter updates are applied to stale state.

Common Patterns

• Mutable fee collector or tax parameter changed without first syncing pending accrual.
• Unstake tax, reward rate, or epoch frequency updates affecting already elapsed time.
• Toggle-style parameters (address(0) sentinel, pause/unpause) that alter future and past calculations simultaneously.
• Setter functions that bypass the same accounting hooks used by normal user actions.

Detection Heuristics

• For each admin setter, identify all variables that depend on elapsed time since last update.
• Verify setters call the same _update*, _accrue*, or checkpoint routines as user-facing flows.
• Test state transitions with long inactivity windows and then a single governance change.
• Check whether parameter changes can reorder who receives already-accrued rewards.

Examples from Audits

• Fee-collector changes that prevented expected debasing in hindsight or triggered abrupt catch-up effects.
• Tax parameter updates that applied to previously elapsed yield windows, redistributing value unexpectedly.
• Configuration changes that could move protocol behavior into disruptive states immediately after activation.

Remediation

Require a deterministic pre-update checkpoint in every setter that influences accrual math. Apply parameter changes only after accrued state is finalized to the current timestamp or epoch boundary. Where governance changes are sensitive, add delay and staged execution with explicit before/after snapshots. Include invariant tests asserting that total distributable value is conserved across parameter changes and that historical periods are not recomputed with new settings.