An attacker can extend lock duration for other users

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L382

Vulnerability details

Impact

Detailed description of the impact of this finding.

Impact

attacker can extend users lock duration by lockOnBehalf.

Proof of Concept

an attacker can call _lockRecipient for other user address with low amounts of _quantity, causing lockedToken.unlockTime to be increased.

look at code below:

lockedToken.lastLockTime = uint32(block.timestamp);
        lockedToken.unlockTime =
            uint32(block.timestamp) +
            uint32(_lockDuration);

Tools Used

Manual Review

Recommended Mitigation Steps

Allow only msg.sender to call _lock

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Recommended Mitigation Steps

Assessed type

Other