Latency timelocks on certain functions can be bypassed
The functions `switchMaintainerFee()` and `switchWithdrawalBoost()` add a latency of typically three days to the current timestamp at which the new value is meant to be valid. However, they don't limit the number of times this value can be changed within the latency period. This allows a malicious maintainer to set their desired value twice and effectively make the change immediately. Let's take the first function as an example. The first call to it sets a value as the `newFee`, moving the old value to `priorFee`, which is effectively the fee in use until the time lock is up. A follow-up call to the function with the same value as a parameter would mean the “new” value overwrites the old `priorFee` while remaining in the queue for the switch.\\n```\\nfunction switchMaintainerFee(\\n DataStoreUtils.DataStore storage DATASTORE,\\n uint256 id,\\n uint256 newFee\\n) external {\\n DATASTORE.writeUintForId(\\n id,\\n "priorFee",\\n DATASTORE.readUintForId(id, "fee")\\n );\\n DATASTORE.writeUintForId(\\n id,\\n "feeSwitch",\\n block.timestamp + FEE\\_SWITCH\\_LATENCY\\n );\\n DATASTORE.writeUintForId(id, "fee", newFee);\\n\\n emit MaintainerFeeSwitched(\\n id,\\n newFee,\\n block.timestamp + FEE\\_SWITCH\\_LATENCY\\n );\\n}\\n```\\n\\n```\\nfunction getMaintainerFee(\\n DataStoreUtils.DataStore storage DATASTORE,\\n uint256 id\\n) internal view returns (uint256 fee) {\\n if (DATASTORE.readUintForId(id, "feeSwitch") > block.timestamp) {\\n return DATASTORE.readUintForId(id, "priorFee");\\n }\\n return DATASTORE.readUintForId(id, "fee");\\n}\\n```\\n
Add a check to make sure only one value can be set between time lock periods.
```\\nfunction switchMaintainerFee(\\n DataStoreUtils.DataStore storage DATASTORE,\\n uint256 id,\\n uint256 newFee\\n) external {\\n DATASTORE.writeUintForId(\\n id,\\n "priorFee",\\n DATASTORE.readUintForId(id, "fee")\\n );\\n DATASTORE.writeUintForId(\\n id,\\n "feeSwitch",\\n block.timestamp + FEE\\_SWITCH\\_LATENCY\\n );\\n DATASTORE.writeUintForId(id, "fee", newFee);\\n\\n emit MaintainerFeeSwitched(\\n id,\\n newFee,\\n block.timestamp + FEE\\_SWITCH\\_LATENCY\\n );\\n}\\n```\\n