Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users can vote to multiple gauges with max voting power

aksoy

Summary

The vote function in GaugeController allows users to allocate their voting power to a gauge. However, the function does not reduce a user’s available voting power after they have voted. This allows users to vote with their full voting power on multiple gauges simultaneously, effectively duplicating their influence and manipulating the reward distribution.

Vulnerability Details

When a user votes, their voting power (veRAACToken.balanceOf(msg.sender)) is checked. However, this balance is not deducted or locked when voting, meaning the user can vote for multiple gauges with their full voting power each time. This allows a single voter to:

  1. Vote with WEIGHT_PRECISION on multiple gauges.

  2. Influence multiple liquidity pools far beyond their actual veRAAC holdings.

  3. Manipulate gauge rewards, directing an unfair amount of incentives toward certain pools.

function vote(address gauge, uint256 weight) external override whenNotPaused {
​
uint256 votingPower = veRAACToken.balanceOf(msg.sender);
if (votingPower == 0) revert NoVotingPower();
​
uint256 oldWeight = userGaugeVotes[msg.sender][gauge];
userGaugeVotes[msg.sender][gauge] = weight;
_updateGaugeWeight(gauge, oldWeight, weight, votingPower);

Impact

Gauge rewards can be manipulated, allowing a malicious actor to redirect emissions unfairly.

Tools Used

Manual

Recommendations

Introduce a mechanism to track used voting power per user and ensure they cannot exceed their total balance.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::vote lacks total weight tracking, allowing users to allocate 100% of voting power to multiple gauges simultaneously

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::vote lacks total weight tracking, allowing users to allocate 100% of voting power to multiple gauges simultaneously

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.