Even staking a small amount prevent user's overall withdrawal
Vulnerability Details
https://github.com/Cyfrin/2024-01-Morpheus/blob/main/contracts/Distribution.sol#L246
withdraw() checks that if there has been pool.withdrawLockPeriodAfterStake timeperiod after last stake
which is a issue from the pov of stakers as only new deposited amount should be locked for pool.withdrawLockPeriodAfterStake not overall staker's position
Impact
Stakers overall staked amount coule be locked for pool.withdrawLockPeriodAfterStake unconditionally
Tools Used
Manual
Recommendations
Protocol should lock only the new deposited amount. If withdrawLockPeriodAfterStake has beem passed for initial deposits stakers should given chance for withdrawing the assets
I don't think it's a design choice to lock the all the stake amount
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.