Ch_301 - mintRollovers() will skip The user's queue arbitrarily

[sherlock-admin]

Ch_301

medium

mintRollovers() will skip The user's queue arbitrarily

Summary

Vulnerability Detail

In case Bob has already queued up a rollover
Let's say:
All the queues are already minted by relayers for epoch Y. The epoch Y exists and has not started yet

ownerToRollOverQueueIndex[address(Bob)] == rolloverQueue.length - 1
and rolloverAccounting[epoch Y] == rolloverQueue.length - 1

Bob will invoke delistInRollover() this logic will execute

        if (index == length - 1) {
            // if only one item in queue
            rolloverQueue.pop();
            delete ownerToRollOverQueueIndex[_owner];
        }

Now Alice will call enlistInRollover() this logic will execute

else {
            // if not, add to queue
            rolloverQueue.push(
                QueueItem({
                    assets: _assets,
                    receiver: _receiver,
                    epochId: _epochId
                })
            );
        }

After that Eve will also invoke enlistInRollover() this logic will execute

else {
            // if not, add to queue
            rolloverQueue.push(
                QueueItem({
                    assets: _assets,
                    receiver: _receiver,
                    epochId: _epochId
                })
            );
        }

relayer now will call mintRollovers(). only the queue of Eve will execute.
Alice needs to wait until the next epoch Y+1

Impact

mintRollovers() will skip Alice's queue arbitrarily

Code Snippet

Tool used

Manual Review

Recommendation

The protocol should handle this scenario correctly (The queue of both Alice and Eve should be executed)

Duplicate of #72