Core Contracts

Summary

The voting power calculation is inconsistent across different parts of the protocol.

• In BaseGauge, the system uses balanceOf on veRAAC, meaning it considers the raw token balance.

• In Governance, the system uses getVotingPower, which follows the Curve-style time decay model.

This discrepancy creates inconsistencies in how voting power is measured across the protocol.

Vulnerability Details

Example Scenario

1. A user locks 1000 RAAC tokens for 1 year.

2. Over time, the getVotingPower function reduces their voting power, as it follows a time-based decay model.

3. In Governance, the user’s voting power decreases over time (expected behavior).

4. However, in BaseGauge, the user’s power remains based on balanceOf, meaning they always have full power as long as they hold veRAAC.

5. This inconsistency allows users to have higher influence in gauge voting than in governance, potentially skewing incentives and rewards.

Impact

• Unfair Influence – Users can have different voting power depending on which function is used.

• Incentive Misalignment – A user may have full gauge voting power even though their governance power is decaying.

Tools Used

Manual review

Recommendations

Ensure all voting mechanisms use getVotingPower instead of balanceOf, to consistently apply the decay model across the protocol.