Summary

editPool() function allows the owner to modify the parameters of an existing pool. It performs validations, updates pool data, and emits an event to record the changes made to the pool.

Vulnerability Details

The vulnerability lies in users front-running these updates for financial gain or to evade certain checks. For instance, if the owner initiates a transaction to raise the minimalStake from 1e18 to 10e18, a malicious user can front-run the transaction, staking 1e18 to bypass this check:

The pool structure is as follows:

The owner can modify any variable from this structure except isPublic. For instance, if the owner intends to reduce initialReward and extend claimLockPeriod, stakers can front-run the transaction to claim. Moreover, if the owner seeks to alter withdrawLockPeriod for a specific reason, users can front-run the transaction to bypass the withdrawLockPeriod.

Impact

Stakers can front-run the owner's transaction to profit or bypass certain checks.

Tools Used

Manual review

Recommendations

Use flashbots when invoking editPool().