Skip to content

Latest commit

 

History

History
47 lines (24 loc) · 1.71 KB

060.md

File metadata and controls

47 lines (24 loc) · 1.71 KB
Raw

Handsome Wool Bat

Medium

After the delegatee is removed, the user's unlockEpoch does not change

Summary

https://github.com/sherlock-audit/2024-08-morphl2/blob/main/morph/contracts/contracts/l2/staking/L2Staking.sol#L344-L434

Function undelegateStake is used to cancel the delegation for _msgSender and set the unlockEpoch. When the delegatee is already removed, unlockEpoch = currentEpoch() + 1, and when the delegatee is not removed, unlockEpoch = currentEpoch() + 1 + undelegateLockEpochs. Then in the claimUndelegation function, it will be checked whether unlockEpoch is less than or equal to currentEpoch.

However, when the delegatee is removed after the user calls undelegateStake, the user's unlockEpoch remains unchanged, which means that the user will wait more time before claiming.

For example, when currentEpoch = 10, undelegateLockEpochs = 10, user calls undelegateStake, so the unlockEpoch will be 10+1+10 = 21. Later, when currentEpoch = 11, the delegatee is removed. At this point users should be allowed to claim at currentEpoch = 12. But in fact, users can only claim it after currentEpoch >= 21.

It is worth noting that the user cannot call undelegateStake again, which makes the user unable to update unlockEpoch.

Root Cause

After the delegatee is deleted, the user needs to wait more time to claim. At the same time, the user cannot update the unlockEpoch.

Internal pre-conditions

No response

External pre-conditions

  1. User calls undelegateStake
  2. removeStakers is called.

Attack Path

No response

Impact

User has to wait more time to claim.

PoC

No response

Mitigation

Allows the user to update unlockEpoch after the delegatee is removed.