Core Contracts

Summary

The GaugeController contract defines vote delay constants but fails to enforce them in the voting mechanism, allowing users to vote multiple times without any time restrictions between votes. This could potentially lead to vote manipulation through rapid successive voting.

Vulnerability Details

The GaugeController contract includes predefined constants for vote delays:

Additionally, it maintains a mapping to track users' last vote times:

However, the contract fails to implement the actual time delay check in the voting logic. The current implementation allows users to:

1. Call the vote function multiple times without any time restrictions

2. Bypass the intended voting cooldown period

3. Potentially manipulate voting weights through rapid consecutive votes

Impact

• Malicious users can exploit this vulnerability to rapidly change their votes, potentially manipulating gauge weights and reward distributions

• Rapid voting could lead to unfair distribution of rewards and destabilize the intended tokenomics.

Tools Used

Manual Review

Recommendations

Implement the vote delay enforcement in the vote function.

Create a function that allows to update VOTE_DELAY, checking whether the new value is within MIN and MAX values.