Ethena Labs - almurhasan's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDeV2.sol#L126

Vulnerability details

Proof of Concept

System properties are broken when Cooldown duration is changed during an ongoing cooldownduration period and users call multiple times the function cooldownShares/cooldownAssets before unstaking the previous stUSDe . Let’s take a example,

1. Let assume alice has 100 stUSDe in StakedUSDeV2 contract.
2. Currently cooldownduration is 20 days.
3. Alice wants to withdraw 50 stUSDe .
4. Alice calls the function cooldownAssets with 50 as asset input and owner as himself.
5. So state variable is updated as cooldowns[alice].cooldownEnd = 20 days. cooldowns[alice].underlyingAmount = 50.
6. Now DEFAULT_ADMIN_ROLE changes the cooldownduration to 90 days. 7.Before unstaking the previous 50 stUSDe, alice again calls function cooldownAssets with 25 as asset input amount to withdraw 25 stUSDe. Now alice state variable is updated as cooldowns[alice].cooldownEnd = 90 days And cooldowns[alice].underlyingAmount = 75.

Impact

User have to wait longer than expected to unstake his stUSDe.

Tools Used

manual review

Recommended Mitigation Steps

Enable setting a new value for cooldownduration only if there’s no active cooldown and validate that users can’t call cooldownShares/cooldownAssets before unstaking the previous stUSDe or define every cooldown withdrawal differently of a user.

Assessed type

Invalid Validation