jsmi - Not allowed staking position can vote for LUM emissions.

[sherlock-admin4]

jsmi

High

Not allowed staking position can vote for LUM emissions.

Summary

The staking position whose remaining lock period is less than epoch time can vote for LUM emissions.

Vulnerability Detail

The MagicSea DOCS describes as follows.

Only valid Magic LUM Staking Position are allowed to vote. The overall lock needs to be longer then 90 days and the remaining lock period needs to be longer than the epoch time. 1 Magic LUM = 1 Vote

However, the implementation of Voter::vote is the following.

    function vote(uint256 tokenId, address[] calldata pools, uint256[] calldata deltaAmounts) external {
        ......

        // check if _minimumLockTime >= initialLockDuration and it is locked
        if (_mlumStaking.getStakingPosition(tokenId).initialLockDuration < _minimumLockTime) {
            revert IVoter__InsufficientLockTime();
        }
175:    if (_mlumStaking.getStakingPosition(tokenId).lockDuration < _periodDuration) {
            revert IVoter__InsufficientLockTime();
        }

        ......
    }

As shown above, L175 doesn't ensure that the staking position is locked.

Impact

The staking position whose remaining lock period is less than epoch time or even expired can vote for LUM emissions.

Code Snippet

• magicsea-staking/src/Voter.sol#L175

Tool used

Manual Review

Recommendation

It is recommended that modify Voter::vote as the following.

    function vote(uint256 tokenId, address[] calldata pools, uint256[] calldata deltaAmounts) external {
        ......

        // check if _minimumLockTime >= initialLockDuration and it is locked
        if (_mlumStaking.getStakingPosition(tokenId).initialLockDuration < _minimumLockTime) {
            revert IVoter__InsufficientLockTime();
        }
-       if (_mlumStaking.getStakingPosition(tokenId).lockDuration < _periodDuration) {
+       if (_mlumStaking.getStakingPosition(tokenId).startLockTime + _mlumStaking.getStakingPosition(tokenId).lockDuration < block.timestamp + _periodDuration) {
            revert IVoter__InsufficientLockTime();
        }

        ......
    }

Duplicate of #166