KupiaSec - The api.burn function should have cool down period

[sherlock-admin4]

KupiaSec

High

The api.burn function should have cool down period

Summary

Liquidity providers can burn their liquidity tokens anytime regardless minting time.
Attackers can take fees without contributing to the pool using this vulnerability.

Root Cause

There is no cool down period in the api.burn function.

Internal pre-conditions

None

External pre-conditions

None

Attack Path

1. Bob(lp) mints 100 lp_token by depositing 100 in quote token and the total supply of lp_token is 100.
2. Alice opens the long position.
3. The following steps are performed in one transaction:
   • Alice mints 1000 lp_token by depositing 1000
   • Alice closes the long position: she has to pay 10 fees to the pool and the pool's total reserve is 1000 + 100 + 10 = 1110.
   • Alice burns 1000 lp_token: Alice receives 1000 * 1110 / 1100 = 1009

Alice pays 10 fees while closing the position and receives additional 9 fees while burning.
Even though Alice's minted 1000 lp_token did not contribute to the users' positions, she received fees and this is unfair for other liquidity providers.

This vulnerability is available for attackers to frontrun the closing position.

Impact

Fees are distributed to liquidity providers unfairly.

PoC

None

Mitigation

It is recommended to add the cool down period in the api.burn function and make burning available after cool down period.

Duplicate of #94

[KupiaSecAdmin]

Escalate

This is a duplicate of #94

[sherlock-admin3]

Escalate

This is a duplicate of #94

You've created a valid escalation!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[rickkk137]

Escalate

This is a duplicate of #94

root cause is same for both

[WangSecurity]

Agree with the escalation, planning to accept and validate with #94.

[WangSecurity]

Result:
High
Duplicate of #94

[sherlock-admin4]

Escalations have been resolved successfully!

Escalation status:

• KupiaSecAdmin: accepted