This repository has been archived by the owner on Jan 12, 2025. It is now read-only.
qmdddd - The function vote does not check if the position is locked for the current vote period.
#146
Comments
sherlock-admin2
added
the
Duplicate
sherlock-admin4
changed the title
vote does not check if the position is locked for the current vote period.vote does not check if the position is locked for the current vote period.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
qmdddd
Medium
The function
votedoes not check if the position is locked for the current vote period.Summary
The function
votedoes not check if the position is locked for the current vote period. As a result, users can withdraw their position back as soon as they vote.Vulnerability Detail
In the function vote, the protocol checks the
initialLockDurationandlockDurationto ensure the position has a long lock time. However, it does not check if the position is locked for the current period. Therefore, users can withdraw their position back as soon as they vote. As a result, an attacker can increase the weight of a pool without being locked.Impact
An attacker can increase the weight of a pool without being locked.
Code Snippet
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L153-L177
Tool used
Manual Review
Recommendation
Check the position is locked in the current vote period.
Duplicate of #166
The text was updated successfully, but these errors were encountered: