By increasing his lock time, a user who was delegated votes to by other users can lock the deposits for the other users for 5 more years

[code423n4]

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/VotingEscrow.sol#L390-L409

Vulnerability details

Impact

The delegatee of a user decides how long the deposits of the user are locked

Proof of Concept

When calling delegate, users can only delegate their votes to an new address that has a longer or equal locktime than the old one.

require(toLocked.end >= fromLocked.end, "Only delegate to longer lock");

This means that if a user wants to get his votes back from an address he delegated to (current delegate), his lock time must be longer than the log time of the current delegate.

This means that if the current delegatee increases his lock time, the user who wants to delegate his votes back to himself needs to make his locktime bigger than the locktime of the current delegate.
Since the deposit can only be withdrawn when the locktime has been passed, the current delegatee indirectly increases the locktime of all users that have delegated votes to him.

Tools Used

Manual review

Recommended Mitigation Steps

Make it possible for a user to get back his voting power without the need to increase his lock time by checking if msg.sender wants to delegate his voting power to himself.

The locking effect can also be mitigated by reducing the variable LOCKTIME to e.g. 1 year. This would make the impact of being forced to increase the own lock time to be able to withdraw the own deposit smaller.

Assessed type

Governance

[c4-pre-sort]

141345 marked the issue as duplicate of #116

[c4-pre-sort]

141345 marked the issue as duplicate of #82

[c4-judge]

alcueca changed the severity to 2 (Med Risk)

[c4-judge]

alcueca marked the issue as partial-50

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #375

[c4-judge]

alcueca marked the issue as partial-50

[c4-judge]

alcueca marked the issue as duplicate of #182

[c4-judge]

alcueca changed the severity to 3 (High Risk)