Core Contracts

Summary

The abstract contract BaseGaugeis inherited by RAACGauge and RWAGauge, both rely on the voting system to adjust emissions and yield respectively. This is a core functionality.

Users lock RAAC Tokens to gain voting powers and be able to vote on governance using the ve-mechanism.

Vulnerability Details

The problem is that the voting mechanism is vulnerable to manipulation because it doesn't check for voters. This allows each address to vote multiple times and manipulate the result in their favor.

Impact

The RAACGaugeand the RWAGauge are vulnerable to some sort of "Governance Attack" and can have directions manipulated to address malicious needs. It will discourage users from locking RAAC Tokens as their vote power can be overpowered by any malicious user who decides to attack and vote multiple times

Tools Used

Code Review

Recommendations

Implement a vote control to limit voting per address. Or, at least, limit the number of votes per period.