Summary
Record the dust-position stale-entry_time gaming vector as a forward-looking constraint, ahead of any future duration-gated feature.
Motivation
entry_time stamps only on a caller's first-ever deposit and never updates while their balance stays non-zero. Leaving a single-stroop dust balance after withdrawing lets a much-later large deposit inherit the original day-one timestamp. No current entry point reads entry_time for anything but display, so this has zero effect today — but it would be directly exploitable the moment any duration-gated feature (a fee discount, a loyalty multiplier, vesting) is built on top of it, and that's exactly the kind of gap that's cheap to note now and expensive to discover after the feature ships.
Proposed Solution
If no duration-gated feature is currently planned: no code change needed now, just don't build one against raw entry_time without revisiting this first. If one is planned: switch to a size-weighted average timestamp on top-up, so a large late deposit meaningfully pulls entry_time forward rather than inheriting the original stamp wholesale.
Scope
| Field |
Value |
| Area |
Contracts |
| Protocol affected |
None |
| Network |
testnet, mainnet |
| Breaking change? |
No — no code change unless a duration-gated feature is scoped |
Alternatives Considered
Fixing it preemptively regardless of whether any duration-gated feature exists: not worth the complexity today, since entry_time currently has zero functional consequence beyond display.
Acceptance Criteria
Summary
Record the dust-position stale-
entry_timegaming vector as a forward-looking constraint, ahead of any future duration-gated feature.Motivation
entry_timestamps only on a caller's first-ever deposit and never updates while their balance stays non-zero. Leaving a single-stroop dust balance after withdrawing lets a much-later large deposit inherit the original day-one timestamp. No current entry point readsentry_timefor anything but display, so this has zero effect today — but it would be directly exploitable the moment any duration-gated feature (a fee discount, a loyalty multiplier, vesting) is built on top of it, and that's exactly the kind of gap that's cheap to note now and expensive to discover after the feature ships.Proposed Solution
If no duration-gated feature is currently planned: no code change needed now, just don't build one against raw
entry_timewithout revisiting this first. If one is planned: switch to a size-weighted average timestamp on top-up, so a large late deposit meaningfully pullsentry_timeforward rather than inheriting the original stamp wholesale.Scope
Alternatives Considered
Fixing it preemptively regardless of whether any duration-gated feature exists: not worth the complexity today, since
entry_timecurrently has zero functional consequence beyond display.Acceptance Criteria
entry_timeis documented (docs/contracts.mdor equivalent)entry_timefor anything beyond display