Core Contracts

Summary

Vulnerability Details

In vote(), votingPower = veRAACToken.balanceOf(msg.sender) is used to calculate the deduction of the previous weight.

As a result, if a user transfers out a portion of their veRAACToken after their initial vote and then calls vote() again to set their weight to 0, the originally allocated weight cannot be correctly removed.

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/governance/gauges/GaugeController.sol#L200

Consider this scenario:

1. A has 1,000 veRAACToken, vote(gaugeA, 100)

   • veRAACToken.balanceOf(msg.sender) = 1000

   • oldWeight = 0

   • newGaugeWeight = 10
     userGaugeVotes[A][gaugeA] = 100

2. A transfers out 500 veRAACToken and revokes vote, vote(gaugeA, 0)

   • votingPower = veRAACToken.balanceOf(msg.sender) = 500

   • oldWeight = 100

   • newGaugeWeight = 5

remaining 5 was not cleared.