Core Contracts

Summary

The GaugeController::_updateGaugeWeight function is vulnerable to an integer underflow when calculating newGaugeWeight. If oldWeight * votingPower / WEIGHT_PRECISION exceeds oldGaugeWeight, the subtraction operation will result in an underflow, causing the transaction to revert. This could lead to a denial-of-service (DoS) condition, preventing the function from executing successfully.

Vulnerability Details

The vulnerability occurs in the following line of code in GaugeController::_updateGaugeWeight function:

If oldWeight * votingPower / WEIGHT_PRECISION is greater than oldGaugeWeight, the subtraction operation oldGaugeWeight - (oldWeight * votingPower / WEIGHT_PRECISION) will underflow. Since Solidity above 0.8 reverts on underflow, this will cause the entire transaction to fail, potentially disrupting the protocol's functionality.

Scenario:

• Suppose oldGaugeWeight = 100, oldWeight = 200, votingPower = 1000, and WEIGHT_PRECISION = 1000.

• The calculation oldWeight * votingPower / WEIGHT_PRECISION results in 200 * 1000 / 1000 = 200.

• The subtraction oldGaugeWeight - 200 results in 100 - 200 = -100, which causes an underflow and reverts the transaction.

Impact

• If an underflow occurs, the transaction will revert, leading to a DoS scenario.

• It prevents updates to gauge weights, impacting voting power allocation.

Tools Used

Manual code review

Recommendations

Explicitly check for potential underflows before performing the subtraction: