jah - a user can still receive a reward even after the lock expires

[sherlock-admin3]

jah

High

a user can still receive a reward even after the lock expires

Summary

there is no check to force the user to lock again after the lock expired

Vulnerability Detail

the function harvestPosition is used to receive the reward but there is no check if the lock have expired which will lead for a user to receive a reward even after the lock have expired

Impact

a user can lock for some time and still receive rewards after the lock expired

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MlumStaking.sol#L442

Tool used

Manual Review

Recommendation

add a check that prevent for user to receive reward after the lock expired

[WangSecurity]

Invalid based on the discussion under #6 and #166