Lp token transfer without lock data transfer

Impact: Medium

Likelihood: Medium

The LPToken contract allows LP tokens to be freely transferred between addresses. However, the protocol tracks liquidity lock data in the pool contract using the original depositor's address, not the token itself. When LP tokens are transferred to a new address, the lock data remains with the original depositor, making it impossible for the new holder to redeem the underlying assets.

Proof of Concept:

1. Alice deposits 1000 USDC and receives 1000 LP tokens with a 7-day lock:
   • Alice's sum lock: 1000 LP.
2. Alice transfers 500 LP tokens to Bob:
   • Bob's sum lock: 0 LPs.
   • Alice's sum lock still: 1000 LP.
3. After 7 days, Bob tries to redeem his 500 LP tokens:
   • The transaction reverts because 500 LP > _getUserUnlockedLP(bob): 0 as Bob has no lock data.
4. The LP tokens become locked as they can't be redeemed by either Alice (no longer owns tokens) or Bob (no lock data) unless Bob transfers the remaining 500 LP tokens back to Alice.

Consider disallowing LP token transfers entirely, or redesigning the system to manage lock data in a transferable way.

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.