Users Can Game sNOTE Minting If Buybacks Occur Infrequently

[code423n4]

Handle

leastwood

Vulnerability details

Impact

As there is no cooldown when minting sNOTE tokens, users can frontrun calls to TreasuryManager.investWETHToBuyNOTE and receive rewards without having staked for the full duration prior. If these buybacks occur infrequently, it may be possible for a NOTE holder to profit by staking before a call to investWETHToBuyNOTE, waiting for the cooldown to pass before finally redeeming sNOTE to be used in other protocols. This can be repeated again and again to extract additional yield from the protocol.

Proof of Concept

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/TreasuryManager.sol

Tools Used

Manual code review.

Recommended Mitigation Steps

Ensure buybacks occur frequently or consider adding a mechanism to delay deposits to further disincentivize staking gamification.

[jeffywu]

While this is possible, the profitability of this is limited by the price slippage restriction on the treasury manager when they invest WETH to buy NOTE. If there is not a lot of price appreciation and a large base of BPT liquidity then this will not yield very much profit to the attacker, possible not enough to recoup their transaction fees.

Duplicate of #190

[pauliax]

Valid concern. I am making this a primary issue as it contains the sponsor's explanation of why this kind of attack may not be that impactful.