AuditorPraise - reverts in Voter.vote() due to wrong check in BribeRewarder._modify() [DOS]

[sherlock-admin2]

AuditorPraise

High

reverts in Voter.vote() due to wrong check in BribeRewarder._modify() [DOS]

Summary

Vulnerability Detail

Ownership of tokenID won't be transferred to Voter.sol during vote() so the below check in BribeRewarder._modify() is wrong because voter.sol is going to be msg.sender and voter.sol isn't tokenID owner.

    function _modify(uint256 periodId, uint256 tokenId, int256 deltaAmount, bool isPayOutReward)
        private
        returns (uint256 rewardAmount)
    {
        if (!IVoter(_caller).ownerOf(tokenId, msg.sender)) {
            revert BribeRewarder__NotOwner();
        }

_modify() is used by BribeRewarder.deposit() which is called in _notifyBribes()

Voter.vote() will always revert BribeRewarder__NotOwner() because of the wrong check.

Impact

reverts in Voter.vote() due to wrong check in BribeRewarder._modify()

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L264

Tool used

Manual Review

Recommendation

pass the msg.sender that calls Voter.vote() as a param into BribeRewarder.deposit() and then into BribeRewarder._modify() and use it for the check

 if (!IVoter(_caller).ownerOf(tokenId, voter#vote_caller)) {
            revert BribeRewarder__NotOwner();
        }

Duplicate of #39