stake.link

Summary

If the owner decreases the maxLockingDuration, users cannot change their maxLock and will have to wait for the original time to get their tokens back.

Vulnerability Details

The owner can change the maxLockingDuration at any time

Let's say the maxLockingDuration is 4 years and the owner intends to change it to 2 years because owner thinks that 4 years is too long.

Users already created a lock for 4 years (max duration)

If a user wants to initiate an unlock, he has to still wait for 2 years (halfduration) instead of waiting for 1 year now.

Users also cannot change their lock duration to 2 years. The only way to change lock duration is through extendLockDuration(), which calls _storeUpdatedLock() and calls _updateLock().

_updateLock() in SDLPool will check if the locking duration is less than the lock.duration and whether the lock.expiry == 0.

If a user wants to change the lock duration from 4 years to 2 years, _lock.duration will be 4 years, _lockingDuration() will be 2 years. _lock.expiry will be 0, so the if statement will pass, resulting in revert.

This means that a user cannot change the maxlock duration from 4 years to 2 years.

Impact

New users will be able to reap the benefit of a smaller maxlock duration, and old users will be penalized by having to wait for the old duration.

Tools Used

VSCode

Recommendations

Recommend being fair for new and old users, and make sure that all lock duration can be changed accordingly when maxLockDuration is changed by the owner.