twicek - After having roll over once a user will not be able to roll over again

[sherlock-admin]

twicek

medium

After having roll over once a user will not be able to roll over again

Summary

After having roll over once a user will not be able to roll over again. An attacker can get advantage of this issue to grief other users forcing them to delist their roll over.

Vulnerability Detail

When a user call enlistInRollover to roll over his deposit for the first time a new queue item will get pushed to rolloverQueue. A relayer will then call mintRollovers and mint the user roll over. After being minted the roll over, if the user decides to roll over his remaining funds he will not be able to calling enlistInRollover because the index of his queue item has already been used by a relayer for his first roll over. The queue item will get updated but will not be mintable.

Example:

• Alice call enlistInRollover to roll over half of her deposit.
• Bob call mintRollovers and mint all roll over until the index of Alice, which is 10th in the rolloverQueue.
• Alice call enlistInRollover to roll over the other half of her deposit, her queue item is updated but is still 10th in the rolloverQueue.
• Bob calling mintRollovers will never be able to mint the second roll over of Alice and will start minting from the 11th item in the rolloverQueue.

Since the rollover queue is not epoch based, any user can only roll over once and after will never be able to roll over again. The only way to allow users to roll over again is to allow them to push a new queue item in the rolloverQueue array.

This can also be used by an attacker to deny any subsequent user in the rolloverQueue to roll over.

Example:

• Attacker call enlistInRollover to roll over of his deposit.
• Bob call mintRollovers and mint all roll over at least until the index of the attacker.
• Attacker call delistInRollover to delist his roll over. Doing so, the last user in the rolloverQueue will get moved to Attacker's previous index, which cannot be minted anymore.

Impact

Users cannot roll over several times.
An attacker can deny any subsequent user to get minted their roll over.

Code Snippet

enlistInRollover

mintRollovers

delistInRollover

Tool used

Manual Review

Recommendation

Consider setting ownerToRollOverQueueIndex[_receiver] to 0 after a roll over is being minted. This way a new rollover item will be pushed to rolloverQueue if a user wants to roll over the other part of his deposited amount.

Duplicate of #72