MorpheusAI

Summary

_withdraw function in Distribution.sol has a logic error in condition that check current time with that of the pool.payoutStart time.

Vulnerability Details

The || OR logic checks allow the code to be proceed when any one of the two condition is met.

The first condition in require is block.timestamp < pool.payoutStart which checks condition to allow for withdrawal where current time is less than the time of pool.payoutStart.
The block.timestamp < pool.payoutStart will allow any user to withdraw their amount at any time before the lock time has ended.

Impact

The || OR condition can impact the whole lock time for the pool and disturbing the balance by allowing a staker to withdraw their amount during the lock period.

Recommendations

The recommendation is made to remove the block.timestamp < pool.payoutStart and || OR condition and only check for conditions of second instance in which current time is greater than lock period and stake time.