Ethena Labs - young's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDeV2.sol#L82 https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDeV2.sol#L100 https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDeV2.sol#L116

Vulnerability details

Impact

When a user calls cooldownShares or cooldownAssets with a certain amount of shares/assets, his cooldownEnd time for claim with to uint104(block.timestamp) + cooldownDuration. But if he tries to redeem multiple times before claiming, the cooldownEnd will be extended by the last redeem call, this means that the previously unstaked amount (which could be available for claim) is stuck in the contract and unable to claim until some much more time has passed.

Proof of Concept

Consider the following scenario.

1. User Bob wants to quit partially, so he redeemed 1 share on DAY 0 and has to wait 14 days before the final claim.
2. 13 days past (Or even more time), Bob redeems another 1 share on DAY 13, the cooldownEnd has been extended by another 14 days.
3. On Day 14, Bob calls the unstake function, but the transaction is reverted. He can't get the assets for the 1st redemption attempt which is frustrating and this violates the initial design.

In fact, in this scenario, in the worst case, the user has to wait 90 more days which is unacceptable.

Consider another scenario.

1. User Bob wants to quit partially, so he redeemed 1 share on DAY 0 and has to wait 14 days before the final claim.
2. 13 days past (Or even more time), Alice (who has some approvals on Bob) performs the griefing attack and redeems another 1 share on DAY 13, the cooldownEnd has been extended by another 14 days.
3. On Day 14, Bob calls the unstake function, but the transaction is reverted. If Alice keeps attacking like this, Bob will not be able to get his funds back anymore.

Tools Used

Manual

Recommended Mitigation Steps

We recommend setting nonces for each redeem attempt, and thus a cooldown period is set per attempt, so that redeem attempts won't interfere with each other.

Assessed type

Timing