Blocking of BPT Locking Via cooldown

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/convex-platform/contracts/contracts/CrvDepositor.sol#L80

Vulnerability details

Issue: A malicious action by daoOperator can call setCooldown, blocking the ability to lock "Curve". daoOperator also has the ability to set a new daoOperator address, which would make the effects permanent.

Consequences: Permanently inoperable smart contract.

Mitigations:

Solution 1:

• Consider removing the cooldown functionality.
• If cooldown is required for business logic, ensure that the daoOperator is not vulnerable to governance attack.
• Do not allow daoOperator to set a new address.

Solution 2:

• The cooldown could be an upper bounded timestamp instead (so that cooldowns can't be forever, by definition of a cooldown)
• daoOperator should be a multisig wallet with a timelock

[0xMaharishi]

This is intentional to allow potential migration to new veToken if its ever created

[0xMaharishi]

code-423n4/2022-05-aura#6

[dmvt]

This is invalid. The new daoOperator would have the ability to change the value at will. I've said this in other contests, but will say it again here: If we assume the DAO / owner to be a bad actor, the entire protocol is compromised. To mitigate this is to remove the DAO / admin and all associated functionality, which brings with it a net harm to users. Certain protocols, including this one, need to be able to upgrade so that they can continue to function as the rest of the world changes around them. This functionality is by design.