scammed - Voter::startNewVotingPeriod lacks check if the current voting period has ended

[sherlock-admin4]

scammed

Medium

Voter::startNewVotingPeriod lacks check if the current voting period has ended

Summary

Voter::startNewVotingPeriod() does not check if _currentVotingPeriodId has ended.

Vulnerability Detail

The owner can start new voting periods with startNewVotingPeriod(), but the function does not check if the current one has ended, which will make the contract logic inconsistent, as well as BribeRewarder.sol's logic, which is based on the duration of the period.

function startNewVotingPeriod() public onlyOwner {
    _currentVotingPeriodId++;

    // AUDIT - no check if last VotingPeriod ended?

    VotingPeriod storage period = _startTimes[_currentVotingPeriodId];
    period.startTime = block.timestamp;
    period.endTime = block.timestamp + _periodDuration;

    emit VotingPeriodStarted();
}

Impact

Period rewards can remain locked as they are based on _periodDuration.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/Voter.sol#L107-L115

Tool used

Manual Review

Recommendation

Add a check that the timestamp when calling startNewVotingPeriod is after _currentVotingPeriodId.endTime.

[WangSecurity]

Invalid based on the comment #166 (comment).