This happens due to the bad calculations in the _updateGaugeWeight
function
As seen in the GaugeController::vote
function, the votingPower
input of this one is represented by the user's balance of veRAAC
token. If the user purchase more veRAAC
tokens his old votes will increase prior to what they were before, which will lead to improper calculations of gauge votes. The miscalculation on its own will lead to wrongly calculated gauge rewards and wrongly created periods. User is able to perform the following attack vector:
1. He can mint himself a minimum amount of veRAAC
token to prevent the vote
function from revering and then vote for some gauge:
2. Then, right before the `distributeRewards` function is called for the corresponding gauge, he can increase his balance of `veRAAC` tokens and vote for the same gauge but this time with 0 `voteWeight`. This way his previous vote amount will be highly inflated because his `votingPower` is far more compared from before, leading to pure loss of gauge weight
wrongly calculated gauge rewards, wrongly created periods and pure loss of gauge weight.
Manual Review
Save the old vote weight of the user in some new mapping and subtract it from oldGaugeWeight
, when accounting the new vote. Other way to mitigate this is to limit the votes for a gauge to just 1 per user
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.