Core Contracts

Summary

The vote function in GaugeController.sol determines a user's voting power based on their current veRAACToken balance. This design allows users to acquire veRAACToken at any time and immediately influence gauge weights, which can lead to manipulation and unfair voting power distribution.

Vulnerability Details

The vote function retrieves the voting power of the caller using veRAACToken.balanceOf(msg.sender). This means users can lock tokens right before voting and gain immediate influence over gauge weights. This is problematic because it enables last block strategic voting, which can distort the gauge weighting system and disrupt long-term incentive structures.

A more robust implementation would record users' voting power at predefined timestamps, such as every one or two weeks. This would ensure that voting power reflects long-term commitment rather than temporary token acquisitions.

Relevant code in GaugeController.sol:

This logic allows users to obtain veRAACToken just before voting, which is not ideal for a fair voting system.

Impact

• Vote Manipulation: Users can acquire veRAACToken any time to influence gauge weights.

• Unfair Weight Distribution: Long-term holders may be disadvantaged compared to those who time their purchases strategically.

• Protocol Integrity Risks: Short-term manipulation can lead to imbalanced emissions and unfair gauge weight allocations.

Tools Used

Manual code review

Recommended Mitigation

Modify the voting system to consider veRAACToken balances at predefined snapshots rather than the current balance at the time of voting. One approach is to store historical balances at fixed intervals (e.g., weekly) and use those values to determine voting power.

For example:

• Implement a checkpointing system where balances are recorded at specific timestamps.

• Require users to use their veRAACToken balance from a previous snapshot when casting votes.

This approach ensures that gauge voting power is fairly distributed based on long-term holdings rather than short-term token acquisitions.