Core Contracts

Summary:

In

If getUserWeight() is used for reward calculations, users could temporarily boost their weight via flash loans and claim higher emissions.

Vulnerability Details and impact:

The getUserWeight() function is read-only (view), so it does not directly modify state. However, it can introduce security risks if used in reward calculations or gauge weight adjustments.

Flash Loan Weight Exploit

Attack Scenario

If getUserWeight() is used for reward distribution or boosted voting power, attackers can temporarily inflate their weight via flash loans.They can stake a large amount in one transaction, claim higher rewards, and withdraw instantly before the contract updates their real weight.

Tools Used: none

Recommendations:

Use time-weighted averaging instead of instantaneous balances:

function getUserWeight(address user) external view returns (uint256) {

return TimeWeightedAverage.calculate(userWeightHistory[user]);

}

Ensure users must hold a staked balance for a minimum duration before benefiting from a higher weight.