web3pwn - The vote function does not work in case there is BribeRewarder assigned to the pool

[sherlock-admin2]

web3pwn

High

The vote function does not work in case there is BribeRewarder assigned to the pool

Summary

The vote function reverts when a BribeRewarder is assigned due to an incorrect ownership check in its deposit function. This check, intended for the claim function where users claim rewards, incorrectly verifies ownership when called by the Voter contract during voting.

Vulnerability Detail

The vote function does not work when a BribeRewarder is assigned to the pool due to an incorrect check in the BribeRewarder contract. The deposit function of BribeRewarder is called by the Voter while voting. The issue is that the _modify function checks if the msg.sender is the owner of the tokenId. This logic is correct for the claim function where the user claims rewards and is the owner of the tokenId, but not for the deposit function where the msg.sender is the Voter contract.

Issue Scenario:

1. There is a pool to vote for.
2. The BribeRewarder was added to provide bribes for the pool.
3. The user tries to vote for the pool.
4. The call always reverts because the Voter calls the deposit function of BribeRewarder, which triggers _modify to check if the msg.sender is the owner of tokenId.
5. This is incorrect since the msg.sender is the Voter contract in this context.

Impact

It not possible to vote for any pools that have BribeRewarder assigned (core functionality of the protocol).

Code Snippet

• https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/Voter.sol#L225
• https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L144
• https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L264-L266

Tool used

Manual Review

Recommendation

It is recommended to update the deposit logic to ensure it is possible to correctly vote for the pools.

Duplicate of #39