FIAT DAO veFDT contest - 0xf15ers's results

Lines of code

https://github.com/code-423n4/2022-08-fiatdao/blob/fece3bdb79ccacb501099c24b60312cd0b2e4bb2/contracts/VotingEscrow.sol#L493

Vulnerability details

Impact

oldLocked and locked_ referes to same LockedBalance in increaseUnlockTime() while calling _checkpoint

Proof of Concept

  // See IVotingEscrow for documentation
    function increaseUnlockTime(uint256 _unlockTime)
    {
        ........
        LockedBalance memory locked_ = locked[msg.sender];
        uint256 unlock_time = _floorToWeek(_unlockTime); // Locktime is rounded down to weeks
        // Validate inputs
        uint256 oldUnlockTime = locked_.end;
        locked_.end = unlock_time;
        locked[msg.sender] = locked_;
        if (locked_.delegatee == msg.sender) {
            // Undelegated lock
            require(oldUnlockTime > block.timestamp, "Lock expired");
            LockedBalance memory oldLocked = _copyLock(locked_);
            oldLocked.end = unlock_time;
            _checkpoint(msg.sender, oldLocked, locked_); //here oldLocked and locked_ are same 
        }
.............
    }

Tools Used

• Manual analysis

Recommended Mitigation Steps

oldLocked.end = oldUnlockTime