Core Contracts

Summary

The GaugeController contract declares a VOTE_DELAY of 10 days but does not enforce it in the vote() function. This oversight allows users to cast multiple votes in rapid succession.

Vulnerability Details

• Affected Code :

  GaugeController.sol, specifically the vote() function -

  https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/gauges/GaugeController.sol#L184C3-L203C6

• Issue:

  Although lastVoteTime[msg.sender] and VOTE_DELAY are defined, there is no require statement to ensure the caller waits 10 days before voting again. Nor is lastVoteTime[msg.sender] updated to the current timestamp after a vote.

• Exploit Scenario:

  An attacker with a high veRAAC balance can call vote() multiple times in quick succession to rapidly shift gauge weights. This repeated manipulation distorts the reward allocation process and undermines governance.

Impact

• Rapid, repeated voting can skew gauge weights, giving an attacker undue influence over emission distributions.

• Other users’ votes become less meaningful if one party can continuously re-vote to adjust weights.

Tools Used

• Manual code review of GaugeController.sol, focusing on the vote() function implementation.

Recommendations

1. Enforce Vote Delay: Add a check in the vote() function

2. Track Vote Timestamp: Immediately after a successful vote, update the lastVoteTime for msg.sender

   @@ function vote(address gauge, uint256 weight) external override whenNotPaused {

   - if (!isGauge(gauge)) revert GaugeNotFound();

   + if (!isGauge(gauge)) revert GaugeNotFound();

   + require(

   + block.timestamp >= lastVoteTime[msg.sender] + VOTE_DELAY,

   + "Vote delay not yet passed"

   + );

   if (weight > WEIGHT_PRECISION) revert InvalidWeight();

   uint256 votingPower = veRAACToken.balanceOf(msg.sender);

   if (votingPower == 0) revert NoVotingPower();

   @@

   - uint256 oldWeight = userGaugeVotes[msg.sender][gauge];

   - userGaugeVotes[msg.sender][gauge] = weight;

   + uint256 oldWeight = userGaugeVotes[msg.sender][gauge];

   + userGaugeVotes[msg.sender][gauge] = weight;

   + lastVoteTime[msg.sender] = block.timestamp;

   ​

   _updateGaugeWeight(gauge, oldWeight, weight, votingPower);

   emit WeightUpdated(gauge, oldWeight, weight);

   }