Core Contracts

Summary

GaugeController::vote allows to vote with less weight than minimum weight MIN_VOTE_WEIGHT leading to invariant breakage because it doesnt check that weight argument is >= MIN_VOTE_WEIGHT

Vulnerability Details

GaugeController defines MIN_VOTE_WEIGHT variable to define minimum weight allowed to vote in GaugeController::vote function:

MIN_VOTE_WEIGHT variable define 1% as the minimum of user total weight to vote.
However vote function doesnt check that weight argument is >= than MIN_VOTE_WEIGHT:
In [1] it only checks that weight is not greather than 100% of user voting power:
Next in [2] and [3] it assigns and updates gauge weight

So, this leads to invariant breakage, allowing users to vote with arbitrary minimum weight values.

The following PoC shows the described scenario with:

• User with voting power = 1000000000000000000 = 1e18

• Gauge with initial weight = 0
  User calls GaugeController::vote with weight 0.01% ie
  GaugeController.vote(gauge, 1)\

Call succeeds leading to invariant breakage
After call,
gauge final weight = 100000000000000 (10e13)
ie user voted with 0.01% that is less than MIN_VOTE_WEIGHT
But minimum weight should be 10000000000000000 (1e15)

To run the PoC save the following code in test/unit/core/governance/gauges/GaugeController.test.js under "Weight Management" test cases:

Start a node and Execute test with:

Observe user could vote with weight power less than 1%

Impact

Severity: Lacks of check in GaugeController::vote weight argument allows breaking MIN_VOTE_WEIGHT invariant

Tools Used

Manual Review

Recommendations

Implement MIN_VOTE_WEIGHT check in GaugeController::vote