utsav - Voting will be DoS in _modify()

[sherlock-admin2]

utsav

Medium

Voting will be DoS in _modify()

Summary

Voting will be DoS in _modify() due to strict require statement

Vulnerability Detail

When user votes in Voter.sol, it calls deposit() in bribeRewarder.sol & again deposit() calls _modify()

  function deposit(uint256 periodId, uint256 tokenId, uint256 deltaAmount) public onlyVoter {
        _modify(periodId, tokenId, deltaAmount.toInt256(), false);
    }

 function _modify(uint256 periodId, uint256 tokenId, int256 deltaAmount, bool isPayOutReward)
        private
        returns (uint256 rewardAmount)
    {
   @>     if (!IVoter(_caller).ownerOf(tokenId, msg.sender)) {
            revert BribeRewarder__NotOwner();
        }
    //Code...
    }

In the above code, we can see onlyVoter contract can call this function but the issue is in _modify() which checks that only owner of the tokenId can call this otherwise it will revert. As result when voter.sol call this _modify(), it will revert because voter.sol is not the owner of any tokenId

Impact

Voting will be DoSed in _modify()

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L153C4-L229C6
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L144
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L263C6-L266C10

Tool used

VS code

Recommendation

Remove the check

Duplicate of #39