Reentrants - addToPosition() isn't disabled during emergency unlock

[sherlock-admin2]

Reentrants

Medium

addToPosition() isn't disabled during emergency unlock

Summary

addToPosition() doesn't have the isUnlocked() check that is present in createPosition() and _lockPosition().

Vulnerability Detail

In the event where emergency unlock is activated, locks should be disabled and users should only be able to withdraw positions. However, users are able to add to existing positions with addToPosition() because it doesn't have the isUnlocked() check.

Impact

User action that should be blocked, isn't.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/7fd1a65b76d50f1bf2555c699ef06cde2b646674/magicsea-staking/src/MlumStaking.sol#L397-L428

Tool used

Manual Review

Recommendation

Add the isUnlocked() check for addToPosition().

[WangSecurity]

Invalid based on this and this comments.