Core Contracts

Summary

The voteDirection function allows users to vote with a direction parameter, utilizing their voting power. However, instead of calling getVotingPower, it directly checks the balance of veRAACToken for the voting power calculation.

Vulnerability Details

The balance of veRAACToken does not necessarily represent the actual voting power. The getVotingPower function implement additional logic (such as time-weighting), meaning users might have different effective voting power than their token balance suggests.

If the voting power depends only on balanceOf, users will transfer tokens to other account and vote multiple times, artificially inflating their voting influence.

Impact

Users could transfer tokens to multiple wallets and vote multiple times.

Tools Used

Manual Review

Recommendations

Use getVotingPower(msg.sender) Instead of balanceOf(msg.sender);