Silvermist - Voter.sol#vote - Users can continue voting after their lockDuration expire

[sherlock-admin2]

Silvermist

Medium

Voter.sol#vote - Users can continue voting after their lockDuration expire

Summary

Users can continue using their staking after the lockDuration expire.

Vulnerability Detail

Users create positions by staking their money. With their position, they can vote for pools and earn rewards. Users can only vote for their lockDuration time. When their duration expires, they can withdraw their money or extend the lockDuration of their staking to continue participating in voting periods. They should NOT be able to vote for pools if their lockDuration expires. However, there is no check to prevent voting with expired duration.

PoC

Paste the following test in Voter.t.sol

   function testVotingWithoutLockDuration() public {
        _stakingToken.mint(ALICE, 2 ether);

        vm.startPrank(ALICE);
        _stakingToken.approve(address(_pool), 1 ether);
        _pool.createPosition(1 ether, 100 days);
        vm.stopPrank();

        vm.warp(block.timestamp + 101 days);

        vm.prank(DEV);

        _voter.startNewVotingPeriod();

        vm.startPrank(ALICE);
        _voter.vote(1, _getDummyPools(), _getDeltaAmounts());

        assertLt(_pool.getStakingPosition(1).lockDuration, block.timestamp);
    }

Impact

Users can vote with expired staking.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/Voter.sol#L153-L219

Tool used

Manual Review

Recommendation

Before voting ensure the lockDuration is more than the block.timestamp.

        if (_mlumStaking.getStakingPosition(tokenId).lockDuration < block.timestamp) {
            revert IVoter__InsufficientLockTime();
        }

Duplicate of #166