Munchables - fandonov's results

Lines of code

https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L275-L294 https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L311-L398

Vulnerability details

Impact

Let's say there is a scenario where Bob locks very small amounts on behalf of Alice and he resets Alice's unlock time every time. This will lead to Alice not being able to unlock and withdraw her funds.

Proof of Concept

There is a user called Bob. He locks very small amounts for example 1 wei on behalf of Alice in the lockOnBehalf function. The lockOnBehalf function then calls the _lock function which executes the locking of the funds. The problem lies in the _lock function because every time there are new funds locked the unlockTime gets reset with the next line:

 lockedToken.unlockTime =
            uint32(block.timestamp) +
            uint32(_lockDuration);

Bob can lock on behalf of Alice very small amounts very often and he can reset Alice's unlock time every time he does this. This can lead to Alice not being able to withdraw her funds because if Bob does that, the unlock time won't pass and now Alice has a lot of locked funds which she can't unlock.

Tools Used

Manual Review

Recommended Mitigation Steps

Put a minimum deposit amount so if some user wants to DoS someone else he will need to lose a lot of funds or consider not resetting the unlock time if someone locks on behalf of someone else.

Assessed type

DoS