Core Contracts

Summary

At GaugeController::_updateGaugeWeight() the weight math used to compute the new weight is incorrect. This is because this math makes sense if a user's voting power does not change, yet it can in multiple ways. Like the user locking more tokens.

Vulnerability Details

Here is the math logic for it.

It first subtracts X% of the previous votingPower then adds the new X% of the votingPower. This will be correct if votingPower is the same.

Proof Of Concept

Good scenario:

• A user allocates 50% of his voting power to a gauge. Lets say the voting power is 100. Total allocated weight is 50.

• The user re-allocates and decides to increase to 75% of his power. He keeps having the same voting power, so the new weight should be 75.

The code will:

Bad scenario:

If the user between those 2 updates locks more tokens, or the voting power naturally decays as it is supposed to do, the math will be incorrect. Let's showcase the locking more because it is simpler:

• A user allocates 50% of his voting power to a gauge. Lets say the voting power is 100. Total allocated weight is 50.

• User locks more tokens and now has 200 voting power.

• The user re-allocates and decides to increase to 75% of his power. The new weight should be 75% of 200 = 150.

Impact

If users increase their voting power, by locking more tokens for example, they will be unable to vote on gauge controller calling GaugeController::vote(). As this function is the one using _updateGaugeWeight(), see here.

They will be unable to use it probably at least for a year, the minimum lock period to get veTokens. And, if for some reason the linear decay allows them not to revert the function, they will have a greater influence that they should in voting in the gauge.

Recommendations

Account for voting power changes every time the weight is updated on GaugeController::vote(). For this you will probably need to track the last voting power of the user when he last called vote on the controller, and then subtract the respecting amount correctly derived from that and the oldWeight percentage.