scammed - NFT approved users cannot vote

[sherlock-admin4]

scammed

Medium

NFT approved users cannot vote

Summary

Approved users over lsNFT cannot vote via Voter::vote due to strict if check.

Vulnerability Detail

In MlumStaking.sol, approved users for a given lsNFT can perform any operations, but cannot vote because Voter::vote has strict owner check.

function vote(uint256 tokenId, address[] calldata pools, uint256[] calldata deltaAmounts) external {
    if (pools.length != deltaAmounts.length) revert IVoter__InvalidLength();

    // check voting started
    if (!_votingStarted()) revert IVoter_VotingPeriodNotStarted();
    if (_votingEnded()) revert IVoter_VotingPeriodEnded();

    // check ownership of tokenId
    if (_mlumStaking.ownerOf(tokenId) != msg.sender) { // AUDIT - approved users cannot vote 
        revert IVoter__NotOwner();
    }
    ....
    
    ...
}

Impact

Approved addresses cannot vote, thus losing the purpose of approving lsNFTs, while still being able to perform any other operation in MlumStaking.sol.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/Voter.sol#L161-L163

Tool used

Manual Review

Recommendation

Make MlumStaking::_requireOnlyApprovedOrOwnerOf() public and use it instead of ownerOf().

Duplicate of #378