The delegator's lock expiration can be longer than the delegatee's.

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-fiatdao/blob/fece3bdb79ccacb501099c24b60312cd0b2e4bb2/contracts/VotingEscrow.sol#L493-L523

Vulnerability details

Impact

The delegator's lock expiration can be set to be longer than the delegatee's.

Proof of Concept

From the documentation, it is imperative that te delegatee's lock expiration needs to be longer than the delegator as described here : https://code4rena.com/contests/2022-08-fiat-dao-vefdt-contest#:~:text=the%20delegatee%27s%20lock%20expiration%20needs%20to%20be%20longer%20than%20the%20delegator%27s. However, users are allowed to increase their _unlockTime via the increaseUnlockTime () function here https://github.com/code-423n4/2022-08-fiatdao/blob/fece3bdb79ccacb501099c24b60312cd0b2e4bb2/contracts/VotingEscrow.sol#L493-L523

From the increaseUnlockTime () function as shown above, increase in unlockTime does not check to ensure that the new set lock is not greater than the delegatee's lock as envision in the documentation as shown below before setting locked[msg.sender] = locked_;

Tools Used

Recommended Mitigation Steps

increase in unlockTime should check to ensure that the new set lock is not greater than the delegatee's before setting locked[msg.sender] = locked_;

[lacoop6tu]

This is an expected behaviour, if a user delegated, he has to increase the unlock time in order to undelegate or re-delegate