araj - Wrong input validation while checking for locked position in Voter.sol

[sherlock-admin4]

araj

High

Wrong input validation while checking for locked position in Voter.sol

Summary

Wrong input validation while checking for locked position in Voter.sol

Vulnerability Detail

For a user to vote using Voter::vote(), _minimumLockTime should be greater than initialLockDuration and position should be locked.

While checking for locked position, it checks position.lockDuration and this can be issue because lockDuration can be greater than _periodDuration but position is not locked

 @>  if (_mlumStaking.getStakingPosition(tokenId).lockDuration < _periodDuration) {
            revert IVoter__InsufficientLockTime();
        }

// How this works

1. User created a position in MlumStaking.sol with lockDuration = 3 Months, which sets initialLockDuration as well as lockDuration = 3 Months

   // create position
       _stakingPositions[currentTokenId] = StakingPosition({
      @>     initialLockDuration: lockDuration,
           amount: amount,
           rewardDebt: amountWithMultiplier * (_accRewardsPerShare) / (PRECISION_FACTOR),
      @>     lockDuration: lockDuration,
           startLockTime: _currentBlockTimestamp(),
           lockMultiplier: lockMultiplier,
           amountWithMultiplier: amountWithMultiplier,
           totalMultiplier: lockMultiplier
       });

2. After 3 Months, user position will be unlocked, but user can still vote and bypass the above check because lockDuration is still 3 months, which is greater than _periodDuration ie 14 days

Impact

Users with unlocked position can also vote

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L175C7-L177C10
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MlumStaking.sol#L374C7-L383C12

Tool used

Manual Review

Recommendation

Check the position's remaining locked time(MlumStaking::_remainingLockTime()) instead of lockDuration & compare it with _periodDuration

Duplicate of #166