coffiasd - starting new voting period not check current period has already ended

[sherlock-admin2]

coffiasd

High

starting new voting period not check current period has already ended

Summary

starting new voting period not check current period has already ended , which can lead to calculation error result in reward token lost.

Vulnerability Detail

code link

  function startNewVotingPeriod() public onlyOwner {
      _currentVotingPeriodId++;

      VotingPeriod storage period = _startTimes[_currentVotingPeriodId];
      period.startTime = block.timestamp;
      period.endTime = block.timestamp + _periodDuration;//@audit staring new Period not ensure current has end.

      emit VotingPeriodStarted();
  }

From above code we can see there is no check if current period has ended.

when user vote, user -> Voter.sol ->BribeReward.sol to calculate the amount of reward token.

calculation code

    function _calculateRewards(uint256 periodId) internal view returns (uint256) {
        (uint256 startTime, uint256 endTime) = IVoter(_caller).getPeriodStartEndtime(periodId);

        if (endTime == 0 || startTime > block.timestamp) {
            return 0;
        }

        uint256 duration = endTime - startTime;//@audit startNewRound is ensure current round is end which can lead to reward calculation error.
        uint256 emissionsPerSecond = _amountPerPeriod / duration;

        uint256 lastUpdateTimestamp = _lastUpdateTimestamp;
        uint256 timestamp = block.timestamp > endTime ? endTime : block.timestamp;
        return timestamp > lastUpdateTimestamp ? (timestamp - lastUpdateTimestamp) * emissionsPerSecond : 0;
    }

the _amountPerPeriod is a fixed value after admin fund BribeReward.sol contract. Thus the emissions speed is based on endTime - startTime aka period duration.

If the administrator intentionally or unintentionally starts a new voting period early, it will result in the remaining reward tokens being stuck in the contract because the release rate of reward tokens is calculated based on the end time.

Impact

reward tokens being stuck in the contract

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L107-L115

Tool used

Foundry
Manual Review

Recommendation

check if current period has ended before starting new period

@@ -108,6 +108,7 @@ contract Voter is Ownable2StepUpgradeable, IVoter {
         _currentVotingPeriodId++;
 
         VotingPeriod storage period = _startTimes[_currentVotingPeriodId];
+        require(block.timestamp > period.endTime);
         period.startTime = block.timestamp;
         period.endTime = block.timestamp + _periodDuration;

[WangSecurity]

Invalid based on the comment here.