ast3ros - [M-5] Deposit fee can be bypassed by user

[sherlock-admin]

ast3ros

medium

[M-5] Deposit fee can be bypassed by user

Summary

A user can bypass the deposit fee by depositing in the queue and immediately minting Deposit In Queue.

Vulnerability Detail

The Carousel is designed to charge a deposit fee when a depositor deposits directly. The deposit fee is calculated linearly based on the time between the epoch creation and the epoch start (later deposits pay higher fees). However, a user can deposit late without paying any deposit fee by:

• Waiting until before the epoch start, queuing a deposit (Carousel.deposit) and minting Deposit In Queue (Carousel.mintDepositInQueue) immediately (this can be done atomically in one transaction).

A user can do it because:

• No deposit fee is charged when the deposit is made via a queue
  https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L495-L499
• A queue is implemented by the FILO (first in last out) method, so the latest deposit in the queue will be executed first.
  https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L331-L350
• The function mintDepositInQueue can be called by anyone, so the user can call this function to execute the deposit immediately and receive the relayerFee.
  https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L310-L355

Impact

Late depositors can exploit their informational advantage and avoid paying the deposit fee. This creates an unfair and unbalanced situation that allows them to profit at the expense of other depositors.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L495-L499
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L310-L355

Tool used

Manual Review

Recommendation

Some potential solutions are:

• Apply the deposit fee to deposits in the queue as well.
• Restrict the mintDepositInQueue function so that only authorized keepers can call it.

Duplicate of #75