$DEGEN

If you're a Solidity dev and interested in helping out Degen by auditing or reviewing our Locked Degen ERC-20 contract, we'd love your support. Your help in finding bugs or suggesting code improvements would be greatly appreciated! Thanks!

https://github.com/degen-token/degen-smart-contracts/pull/22

Summary:

- DEGEN deposited into the staking contract produces LDEGEN tokens in a 1:1 ratio
- LDEGEN is non-transferable and non-delegatable i.e. purely for accounting purposes
- minimum deposit amount is 10k (can be changed by Degen team)
- lock duration 90 days (can be changed by Degen team, max. of 365 days)
- deposit can be topped up but it will reset the lock duration for preceding deposits to the full duration
- partial withdrawals are allowed

some people is asking about it.. and I had to stop my audit.. after found it..

LN 130 - updateLockDuration() function 
This allow the owner to change the locking period.. between 0-365 days.

LN 118 - if (block.timestamp <= depositTimestamps[msg.sender] + lockDuration) revert...

This check on lockDuration in the withdraw function allows the owner to do some tricks with the locking period: 
 - the owner could lock and unlock by managing to do a sandwich: updateLockFunction-withdraw-updateLockFunction, withdrawing without respecting the lock. And, setting it again locking users funds.
- the owner could extend the locking period, from an initial 0 days to 1 year. Locking user funds for 1 year without user "permission".

Husband, dad, dev • @dune.eth wizard • Ultimate Ⓜ️oxie Dashboard https://tinyurl.com/moxiedash • Ultimate Degen Tips FAQ https://tinyurl.com/degenfaq

any thought on this:
https://warpcast.com/j-valeska/0xfbcf88e7