Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect gauge controller weight update

robertodf99

Summary

Users vote for the rewards allocation to each gauge in the gauge controller. The user chooses the desired weight and the power is determined by the veToken holdings. There is an issue with the math used updating the voted gauge weight when a user votes for the second time having a different voting power. The guage wieght has to be updated based on the old voting power-old weight pair and new voting power-new weight, however the code currently uses old weight-new voting power and new weight-new voting power:

function _updateGaugeWeight(
address gauge,
uint256 oldWeight,
uint256 newWeight,
uint256 votingPower
) internal {
Gauge storage g = gauges[gauge];
uint256 oldGaugeWeight = g.weight;
uint256 newGaugeWeight = oldGaugeWeight -
((oldWeight * votingPower) / WEIGHT_PRECISION) +
((newWeight * votingPower) / WEIGHT_PRECISION);
​
g.weight = newGaugeWeight;
g.lastUpdateTime = block.timestamp;
}

This allows an arbitraguer to allocate weight to a vault without holding veTokens, follow the next rationale using and :

Where:

  • vp: voting power

  • w: weight

The wieght assigned to the gauge is and the users does not hold any veToken.

Vulnerability Details

Impact

Tools Used

Manual review.

Recommendations

Store the last voting power along with the last weight used by the user and use it instead of the new voting power to remove the previous weight allocation

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::_updateGaugeWeight uses current voting power for both old and new vote calculations, causing underflows when voting power increases and incorrect gauge weights

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::_updateGaugeWeight uses current voting power for both old and new vote calculations, causing underflows when voting power increases and incorrect gauge weights

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.