0xAnmol - Double voting is possible if the user withdraws and reopens a position within the voting duration.

[sherlock-admin3]

0xAnmol

High

Double voting is possible if the user withdraws and reopens a position within the voting duration.

Summary

A staked user can withdraw his MLUM after voting and restake it to vote again, resulting in double voting.

Vulnerability Detail

Users who have an MLUM staked in the [mlumStaking.sol](http://mlumstaking.aol/) can vote in the voter.sol. The voting weight depends on the staked amount.

To exploit this, a user can stake before the voting begins and set the duration to the minimum required lock duration. After the voting period starts, the user can vote with their weight, withdraw the staked tokens, restake them, and vote again in the same pool within the same periodId.

POC

Here is a simple POC on how an attacker can do that.

1. Alice created a 2-week position with 1e18 MLUM
2. 13 days pass and Alice 1 day away from his expiry
3. New voting period starts with 2 weeks duration
4. Alice vote
5. After 1 days Alice withdraw his MLUM
6. Restake
7. Vote Again

Paste this test in Voter.t.sol

  function testVoteTwice() public {
        _createPosition(ALICE);
        vm.warp(block.timestamp + 13 days); // 13 days
        vm.prank(DEV);
        _voter.startNewVotingPeriod();

        vm.startPrank(ALICE);
        _voter.vote(1, _getDummyPools(), _getDeltaAmounts());

        vm.warp(block.timestamp + 1 days);

        vm.startPrank(ALICE);
        _pool.withdrawFromPosition(1, 1 ether);

        _createPosition(ALICE);
        vm.startPrank(ALICE);
        _voter.vote(2, _getDummyPools(), _getDeltaAmounts());
    }

Impact

Double voting is breaking the fairness of the voting system. A malicious actor can use this to promote their pool in an unethical way.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/Voter.sol#L153

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/MlumStaking.sol#L496

Tool used

Manual Review

Recommendation

Do not allow stakers to withdraw from their position if they are already voting.

Duplicate of #166