Extending/reducing cooldown period affects already queued withdrawals

[howlbot-integration[bot]]

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/519e518f2d8dec9acf6482b84a181e403070d22d/contracts/Withdraw/WithdrawQueue.sol#L287

Vulnerability details

Descritpion

Whene users initiated a withdrawl they are expecting to wait until current cooldown period ends to be able to claim their funds. However if the current cool down period is modified, this will affect this time.

Impact

Arbitrary extension of cooldown period can affect users that are waiting for their funds to be available.

POC

Call of WitdrawQueue.updateCoolDownPeriod(uint256 _newCoolDownPeriod) will affect current queued withdrawls extending their duration of coolDownPeriod < _newCoolDownPeriod given current implementation of function claim

Recommended mitigation

Record the current cooldown period when a user initiate a withdrawl and use this value to calculate the time when the funds will be available to claim.

    function claim(uint256 withdrawRequestIndex) external nonReentrant {
        // ...
-       if (block.timestamp - _withdrawRequest.createdAt < coolDownPeriod) revert EarlyClaim();
+        if (block.timestamp - _withdrawRequest.createdAt < _withdrawRequest.coolDownPeriod) revert EarlyClaim();
        //...
    }

Assessed type

Other

[c4-judge]

alcueca marked the issue as duplicate of #607

[c4-judge]

alcueca marked the issue as unsatisfactory: Invalid

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-b