Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Users Can Vote on Inactive Gauges, Wasting Voting Power

0xterrah

Relevant GitHub Links

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/gauges/GaugeController.sol#L190-L202

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/interfaces/core/governance/gauges/IGaugeController.sol#L33

Summary

The vote() function in GaugeController.sol lacks a check for gauge activity status, allowing users to waste voting power on inactive gauges.

Vulnerability Details

The GaugeController.vote() function only verifies if a gauge exists but not if it's active:

function vote(address gauge, uint256 weight) external override whenNotPaused {
if (!isGauge(gauge)) revert GaugeNotFound();
if (weight > WEIGHT_PRECISION) revert InvalidWeight();
// ... rest of function
}

Each gauge has an isActive boolean that can be toggled by admin:

struct Gauge {
uint256 weight;
uint256 typeWeight;
uint256 lastUpdateTime;
GaugeType gaugeType;
bool isActive; // Not checked in vote()
uint256 lastRewardTime;
}

Impact

  • Users can waste voting power on inactive gauges that won't receive rewards

  • Reduces governance effectiveness as votes get misallocated

  • Skews weight distribution in active gauges

Tools Used

Manual Review

Recommendations

Add activity check in the vote() function:

function vote(address gauge, uint256 weight) external override whenNotPaused {
if (!isGauge(gauge)) revert GaugeNotFound();
if (!gauges[gauge].isActive) revert GaugeNotActive();
if (weight > WEIGHT_PRECISION) revert InvalidWeight();
// ... rest of function
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::vote allows users to waste voting power on inactive gauges that don't receive rewards

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::vote allows users to waste voting power on inactive gauges that don't receive rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!