search

code-423n4 / 2021-04-maple-findings

0 stars 0 forks source link

zero cooldown should be explicitly allowed as per comment #101

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

paulius.eth

Vulnerability details

Vulnerability details

function isReceiveAllowed has a comment: "This is only possible if they have zero cooldown or they are passed their withdraw window.", however, it does not explicitly check if withdrawCooldown is zero, so theoretically it could still forbid the receives if lpCooldownPeriod or lpWithdrawWindow is set to a very high value. It is only possible if a malicious governor takes over the control which we should assume is very unlikely.

Recommended Mitigation Steps

Explicitly allow if unstakeCooldown == 0.

lucas-manuel commented 3 years ago

If they have zero cooldown block.timestamp > 0 + globals.stakerCooldownPeriod() + globals.stakerUnstakeWindow() is true, if they have an unstakeCooldown set, it will only be true after their window has passed. This is not a bug.