Early withdrawal penalty fee mechanism bypass
A logic flaw allowed users to bypass the early-withdrawal penalty mechanism that was supposed to disincentivize unlocking veNFTs before their lock period ended.
Description
Neverland implements an early-withdrawal penalty fee designed to keep users honest about their lock commitments. A logic flaw in the withdrawal path allowed users to bypass this penalty entirely, effectively removing the economic disincentive that backed long-term lock decisions.
Impact
- Loss of revenue to the protocol from missed penalty fees.
- Long-term locks no longer provide meaningful commitment, weakening the governance and emissions design that depends on lock duration.
- Users who locked under the assumption of a stable penalty incentive find the economic guarantee was illusory.
Recommendation
Restore the penalty fee logic in all withdrawal code paths and add invariant tests asserting that any unlock before the lock expiry pays the configured penalty.
Composable Security ID: NRL-6c19a5e-C01. Neverland Money: Fixed. Composable Security: Fix verified during retest (2025-08-22).
See the full report for the complete write-up.