Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Weight Manipulation Exploit

olami9783

Summary

The castVote()function retrieves the current voting power at the time of voting using

​
uint256 weight = _veToken.getVotingPower(msg.sender);
if (weight == 0) {
revert NoVotingPower(msg.sender, block.number);
}

This allows users to increase their veToken holdings after a proposal has started and vote with an inflated influence

Vulnerability Details

  • A proposal is created, and voting begins.

  • A user has low veToken holdings at the start

  • The user observes early votes and buy more veTokens

  • The user calls castVote(), and the function fetches their updated (higher) voting power.

  • The user casts a disproportionately large vote, manipulating governance outcomes.

This exact issue was exploited in compound finance (COMP Governance), where users were able to borrow COMP tokens and vote with them, significantly influencing proposal outcomes.

Impact

Governance takeover and undermines the legitimacy of user

Tools Used

Bypassing fair voting

Recommendations

Implement snapshot based voting power at the time of proposal creation.
Modify castVote() to use the stored snapshot instead of live balances.
Prevent mid-vote power accumulation from affecting voting weight

  • Governance should be predictable: users should not be able to change voting power after proposal creation.

  • Taking snapshot ensures fairness.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance.castVote uses current voting power instead of proposal creation snapshot, enabling vote manipulation through token transfers and potential double-voting

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Governance.castVote uses current voting power instead of proposal creation snapshot, enabling vote manipulation through token transfers and potential double-voting

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.