Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

user can mess up the gauge weight by voting, then getting more `veRAAC` and voting again for the same gauge in `GaugeController`

kirobrejka

Summary

This happens due to the bad calculations in the _updateGaugeWeight function

Vulnerability Details

function _updateGaugeWeight(
address gauge,
uint256 oldWeight,
uint256 newWeight,
uint256 votingPower
) internal {
Gauge storage g = gauges[gauge];
​
uint256 oldGaugeWeight = g.weight;
@> uint256 newGaugeWeight = oldGaugeWeight -
@> ((oldWeight * votingPower) / WEIGHT_PRECISION) +
@> ((newWeight * votingPower) / WEIGHT_PRECISION);

As seen in the GaugeController::vote function, the votingPower input of this one is represented by the user's balance of veRAAC token. If the user purchase more veRAAC tokens his old votes will increase prior to what they were before, which will lead to improper calculations of gauge votes. The miscalculation on its own will lead to wrongly calculated gauge rewards and wrongly created periods. User is able to perform the following attack vector:
1. He can mint himself a minimum amount of veRAAC token to prevent the vote function from revering and then vote for some gauge:

function vote(
address gauge,
uint256 weight
) external override whenNotPaused {
if (!isGauge(gauge)) revert GaugeNotFound();
if (weight > WEIGHT_PRECISION) revert InvalidWeight();
​
uint256 votingPower = veRAACToken.balanceOf(msg.sender);
@> if (votingPower == 0) revert NoVotingPower();
​
 2. Then, right before the `distributeRewards` function is called for the corresponding gauge, he can increase his balance of `veRAAC` tokens and vote for the same gauge but this time with 0 `voteWeight`. This way his previous vote amount will be highly inflated because his `votingPower` is far more compared from before, leading to pure loss of gauge weight

Impact

wrongly calculated gauge rewards, wrongly created periods and pure loss of gauge weight.

Tools Used

Manual Review

Recommendations

Save the old vote weight of the user in some new mapping and subtract it from oldGaugeWeight, when accounting the new vote. Other way to mitigate this is to limit the votes for a gauge to just 1 per user

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::_updateGaugeWeight uses current voting power for both old and new vote calculations, causing underflows when voting power increases and incorrect gauge weights

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::_updateGaugeWeight uses current voting power for both old and new vote calculations, causing underflows when voting power increases and incorrect gauge weights

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!