Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Double-balance attack in GaugeController allows user to use same balance to vote in different Gauges

holydevoti0n

Vulnerability Details

The vote() function takes a user's voting power based on their veRAACToken balance:

function vote(address gauge, uint256 weight) external override whenNotPaused {
if (!isGauge(gauge)) revert GaugeNotFound();
if (weight > WEIGHT_PRECISION) revert InvalidWeight();
@> uint256 votingPower = veRAACToken.balanceOf(msg.sender);
if (votingPower == 0) revert NoVotingPower();
​
uint256 oldWeight = userGaugeVotes[msg.sender][gauge];
@> userGaugeVotes[msg.sender][gauge] = weight;
_updateGaugeWeight(gauge, oldWeight, weight, votingPower);
emit WeightUpdated(gauge, oldWeight, weight);
}

However, when users vote for different gauges, there's no mechanism to track the total amount of voting power they've used across all gauges. The contract only tracks individual gauge votes in userGaugeVotes[msg.sender][gauge].

This means a user with X amount of veRAACToken balance could potentially:

  • Vote with weight 10000 (max) for Gauge A

  • Vote with weight 10000 (max) for Gauge B

  • Vote with weight 10000 (max) for Gauge C And so on, effectively multiplying their voting power across multiple gauges.

Impact

Users exceed 100% of their voting power across multiple gauges, which could lead to disproportionate influence over the emission distribution.

Tools Used

Manual Review

Recommendations

Track the total voting power used across all gauges for each user and ensure that the sum of a user's votes across all gauges cannot exceed their total voting power.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::vote lacks total weight tracking, allowing users to allocate 100% of voting power to multiple gauges simultaneously

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::vote lacks total weight tracking, allowing users to allocate 100% of voting power to multiple gauges simultaneously

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.