Open code423n4 opened 2 years ago
Patched in mainnet deployment
The warden has found a way to sidestep the loss of rewards that automatically happens due to the faulty checkpoint system that always sets voted to false.
In doing so they also showed how the system can fall apart and provided a POC to replicate.
Because I've rated issues related to the voted
checkpoints and loss of rewards with High Severity, at this time I believe this finding should also be bumped as it shows how the system is broken and the way to avoid a loss of rewards
The sponsor seems to have remedied by deleting the voted logic
Lines of code
https://github.com/code-423n4/2022-05-velodrome/blob/7fda97c570b758bbfa7dd6724a336c43d4041740/contracts/contracts/Gauge.sol#L195 https://github.com/code-423n4/2022-05-velodrome/blob/7fda97c570b758bbfa7dd6724a336c43d4041740/contracts/contracts/Gauge.sol#L489-L490 https://github.com/code-423n4/2022-05-velodrome/blob/7fda97c570b758bbfa7dd6724a336c43d4041740/contracts/contracts/Gauge.sol#L499-L500
Vulnerability details
Impact
this line in
gauge.earned
function looks like the intention here is to incentivize users to keep theirescrow.balanceOfNft
voted for this gauge.However, it's enough to vote just before claiming rewards (even in the same transaction) and
voter.reset
just after receiving rewards to pass thisif
and get rewards for full period since last interaction with the gauge.Proof of Concept
I'm pasting my test file:
Note, that Bob kept his votes for this gauge for full 6-day period but Alice just voted before claiming rewards. In logs, we can see that they both received the same (non-zero) amount of VELO tokens.
Alice can reset her votes in the same transaction after claiming rewards, if she decides to do so.
Tools Used
Foundry
Recommended Mitigation Steps
A partial solution would be to create a new checkpoint each time user's
voted
status changes (setVoteStatus
is called) instead of overwriting thevoted
in last one.However, even then, users can just assign very small weight to this gauge, and lock very little VELO, so I don't think this
if
statement helps with anything. I think, it's better to rethink how to incentivize users to vote for specific gauges.