0xBhumii - Lack of Validation for Updating Minimum Lock Time in Voting Contract

[sherlock-admin3]

0xBhumii

High

Lack of Validation for Updating Minimum Lock Time in Voting Contract

Summary

The Voter contract allows the owner to update the minimum lock time for voting eligibility without any validation checks or restrictions. This can lead to a situation where users who have locked their tokens for the initial minimum period may lose their voting power if the minimum lock time is increased. This issue can result in users losing their ability to participate in ongoing voting periods, undermining the fairness and predictability of the voting process.

Vulnerability Detail

In the Voter contract, the owner can update the minimum lock time required for voting by calling the updateMinimumLockTime function. However, this function lacks any validation or restrictions, allowing the owner to arbitrarily increase the minimum lock time. If users have locked their tokens for the initially specified minimum period and the owner increases the minimum lock time during an ongoing voting period, these users will lose their voting power for that period. This creates an unfair scenario where users cannot predict or rely on their voting eligibility

Impact

Users who have locked their tokens for the initially specified minimum period may lose their voting power if the minimum lock time is increased by the owner. This undermines the fairness and predictability of the voting process, leading to potential user dissatisfaction and loss of trust

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L172

 function updateMinimumLockTime(uint256 lockTime) external onlyOwner {
        if (lockTime == 0) revert IVoter_ZeroValue();
        _minimumLockTime = lockTime;
        emit MinimumLockTimeUpdated(lockTime);
    }

Tool used

Manual Review

Recommendation

Modify code in a way it changes to the minimum lock time should only take effect after the current voting period has ended

function updateMinimumLockTime(uint256 lockTime) external onlyOwner {
    if (lockTime == 0) revert IVoter_ZeroValue();
    if (_votingStarted() && !_votingEnded()) revert IVoter__CannotUpdateDuringVoting();

    _minimumLockTime = lockTime;
    emit MinimumLockTimeUpdated(lockTime);
}

[WangSecurity]

Invalid based on the comment #166 (comment)