search

sherlock-audit / 2024-06-magicsea-judging

2 stars 0 forks source link

Honour - Default _maxLockMultiplier exceeds the MAX_LOCK_MULTIPLIER_LIMIT #628

Closed sherlock-admin2 closed 1 month ago

sherlock-admin2 commented 2 months ago

Honour

Medium

Default _maxLockMultiplier exceeds the MAX_LOCK_MULTIPLIER_LIMIT

Summary

Default _maxLockMultiplier exceeds the MAX_LOCK_MULTIPLIER_LIMIT

Vulnerability Detail

The default _maxLockMultiplier set on initialization is 20000(200%) which is greater than the constant MAX_LOCK_MULTIPLIER_LIMIT = 15000(150%). This constraint is only applied on setLockMultiplierSettings

Impact

Contradictory functionality

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MlumStaking.sol#L67-L73

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MlumStaking.sol#L103-L110

Tool used

Manual Review

Recommendation

Either _maxLockMultiplier or MAX_LOCK_MULTIPLIER_LIMIT should be set appropriately

Duplicate of #125