evan - DepositFee can be avoided completely

[sherlock-admin]

evan

medium

DepositFee can be avoided completely

Summary

By queuing their deposit and immediately calling mintDepositInQueue in the same transaction, the user completely avoids paying the deposit fee.

Vulnerability Detail

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L479-L489
If the user wants to deposit immediately (without queuing), they get charged a deposit fee (the calculation of which encourages early deposits).

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L334
There is no such calculation in mintDepositInQueue.

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L330
Also observe that the depositQueue is last-in-first-out.

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L495
The user can simply queue their deposit and call mintDepositInQueue with _operations=1 in the same transaction. They get to immediately deposit without getting charged the deposit fee.

Impact

Users can avoid deposit fee. This also means that there's no longer an incentive to deposit early.

Code Snippet

See Vulnerability Detail

Tool used

Manual Review

Recommendation

This would depend on the intended behavior. One solution is to add the deposit fee calculation to mintDepositInQueue as well. However, a downside of this approach is that the amount of deposit fee is now in the control of the relayer instead of the user.

Duplicate of #75