triggerDepeg() and triggerEndEpoch() can be frontrunned

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Vault.sol#L203

Vulnerability details

Impact

In Vault.withdraw() you have modifier epochHasEnded(). But it's just checking time, no check if Controller already called triggerDepeg() or triggerEndEpoch()

So anyone can frontrun Controller transactions and withdraw their funds before without losses. For example risker can frontrun trx and withdraw funds in case of triggerDepeg() without funds loss

entitledAmount =
                    // @audit-ok high сначала делим - разве это не приведет к проблемам
                    amount.divWadDown(idFinalTVL[id]).mulDivDown(
                        idClaimTVL[id],
                        1 ether
                    ) +
                    amount;

So he will save his funds and get amount back

https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Vault.sol#L203

Tools Used

vs code

Recommended Mitigation Steps

Add explicit var, tells that epoch already ended by Controller. And only after that allow users to withdraw funds

[3xHarry]

dup #421

[HickupHH3]

dup #69

[0xRuslanSh]

Hi guys!
No 'Confirmed' label here, is it ok?
@HickupHH3

[HickupHH3]

@Ruslan2702 yes it's ok, it's been marked as a dup.