The protocol Levels::addLevel function allows the LEVEL_OPERATOR_ROLE to introduce new NFT levels. However, the function does not validate the _levelAndSupply.level.maturityBlocks input paramater, allowing a new level to be added with maturityBlocks = 0.
Vulnerability Details
Inside Levels::addLevel, the function validates only:
The currentStargate and StargateNFT contract does not implement the Levels::updateLevel from libraries to prevent when this scenario occur. It allowing user to backrun and mint the misconfigured level before protocol pause and upgrade the contract to implement function Levels::updateLevel. The updated level is only applies to the next minting and NFTs that have already been minted will not be affected.
This creates an unintended economic advantage for any user who immediately backruns the level addition and mints the NFT.
Impact Details
when LEVEL_OPERATOR_ROLE unintentionally sets maturityBlocks = 0, users can:
Immediately stake to mint the NFT
Receive an NFT that is already considered matured
Delegate instantly without waiting or paying boost
and if the added level is a level that has a high scaledRewardFactor then the user who immediately backruns and mints the NFT will get a huge advantage.