nikhil840096 - Voting Malfunction Leading to Core Protocol Vulnerability

[sherlock-admin2]

nikhil840096

High

Voting Malfunction Leading to Core Protocol Vulnerability

Summary

Function Voter:vote is responsible to vote for a particular pool, only stakers of Mlum in MlumStaking.sol can call this function, While there is a check which is stopping to execute whole vote function and impacting the core functionality of the protocol.

Vulnerability Detail

When the staker Of Mlum will call vote function with the parameters
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L153-L156
All check will passed and execution will proceed to _notifyBribes
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L211
If we look at the execution of this function
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L221-L229
For each rewarder it will call the deposit function of that rewarder contract, and the rewarder here is BribeRewarder
If we look at BribeRewarder:deposit function
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L143-L147
It has a modifier onlyVoter which checks if the called is the voter contract or not, so this will pass as the msg.sender is the voter contract.
Then it calls _modify function ,if we look at that function
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L260-L267
In starting of the execution of the function there is a check, which checks if the owner of the tokenId(The staking position's tokenId )
is msg.sender or not, if not then it reverts and will halt full execution of vote function. So as msg.sender is the Voter so this will get failed.

Impact

The voting will not work breaking the core functionality of the function.
High

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L260-L267

Tool used

Manual Review

Recommendation

Remove the check in _modify for the owner of the tokenId as it has been already verified in the voter.sol, and add a check in function claim to verify it the msg.sender is the owner of tokenId.

Duplicate of #39