stake.link

Summary

The SDLPoolPrimary contract allows unrestricted updates to locks even after their unlock period has been initiated. The contract lacks explicit checks to prevent modifications to locks once the unlock process has started.

Vulnerability Details

The initiateUnlock function initiates the unlock period for a lock. However, the contract does not explicitly restrict further updates to the lock after this point. The relevant code snippet is as follows:

The if (locks[_lockId].expiry != 0) check prevents the initiation of the unlock period if it has already started. However, once the unlock period has been initiated, the contract does not include further checks to restrict updates to the lock.

Impact

This vulnerability allows malicious actors to modify locks even after they have been fully unlocked, potentially leading to unexpected behavior or exploitation of the contract's logic.

Tools Used

Manual

Recommendations

Implement a check in relevant functions (e.g., _storeUpdatedLock) to ensure that the lock cannot be updated once its unlock period has started.