Disapprovals are not checked when approving price

[howlbot-integration[bot]]

Lines of code

https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L177-L207 https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L210-L242

Vulnerability details

Impact

There is inconsistency in validation between approving & disapproving the proposed price.

Proof of Concept

While disapproving a proposal, whether the same user has approved the same proposal or not is checked

if (usdUpdateProposal.approvals[msg.sender] == _usdProposalId)
    revert ProposalAlreadyApprovedError();
if (usdUpdateProposal.disapprovals[msg.sender] == _usdProposalId)
    revert ProposalAlreadyDisapprovedError();

But when approving the proposal, no check is there for whether the same user has disapproved it or not.

if (usdUpdateProposal.approvals[msg.sender] == _usdProposalId)
    revert ProposalAlreadyApprovedError();

Recommended Mitigation Steps

Perform the below check in approveUSDPrice

if (usdUpdateProposal.disapprovals[msg.sender] == _usdProposalId)
    revert ProposalAlreadyDisapprovedError();

Assessed type

Invalid Validation

[c4-judge]

alex-ppg marked the issue as satisfactory