Delegatees can keep delegator's deposits against their will using frontrunning

[code423n4]

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/VotingEscrow.sol#L384

Vulnerability details

Impact

A voter cannot redelegate his deposit except the new delegatee has a higher lock time than the current delegatee.

   require(toLocked.end >= fromLocked.end, "Only delegate to longer lock");

This is a good design choice for the benefit of the protocol. But for a user that wants to redelegate, undelegate he may be prevented by the current delegatee.

The current delegatee can achieve this by frontrunning any transaction that wants to redelegate an amount currently delegated to him. The frontrun transaction will increase his lock time, which will make the incoming transaction invalid. Although this can be avoided if the transaction is sent through a private RPC URL or if the new delegate's lock time can be increased and the delegation happens in the same block.
Depending on the technical level of the voter, this might be feasible to perform.

Ultimately, the lock time of the new delegatee has to be increased to redelegate or undelegate which may not be favorable for him.

Proof of Concept

1. Alice creates a lock and deposits 5 CANTO in the Voting Escrow.
2. Alice delegates to another user.
3. Alice tries to redelegate but is frontrun by her current delegatee, which leaves her deposits stuck with the delegatee.

Tools Used

Vscode

Recommended Mitigation Steps

The current check seems more like a design choice to make sure voters remain in the contract longer than their lock time. Replacing it with the check below will help achieve the same objective with no detriment to the voter.

        require(toLocked.end >= locked_.end, "Cannot delegate to shorter lock");

Assessed type

Invalid Validation

[c4-pre-sort]

141345 marked the issue as duplicate of #116

[c4-pre-sort]

141345 marked the issue as duplicate of #82

[c4-judge]

alcueca changed the severity to 3 (High Risk)

[c4-judge]

alcueca changed the severity to 2 (Med Risk)

[c4-judge]

alcueca marked the issue as partial-50

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #375

[c4-judge]

alcueca marked the issue as partial-50

[c4-judge]

alcueca marked the issue as duplicate of #182

[c4-judge]

alcueca changed the severity to 3 (High Risk)