Open hats-bug-reporter[bot] opened 2 months ago
POC is needed, as there are inconsistencies and lack of clarity on the ultimate benefit of the user, how much more voting power will be, etc. and in which cases this will actually occur Also, there is incomprehensibility (e.g., reduced amount, same or less locking period than originally locked) - it can only increase the locking time or the amount or using permanent lock, but then neglects these things and calculations
Please provide Poc
Github username: -- Twitter username: -- Submission hash (on-chain): 0x70068c7db5319f0ceee3a30f2246452c3a8abfa0e147a3a3fd9064c88c4b87ab Severity: medium
Description: Description\
The exploitable vulnerability in the provided Solidity code exists in the
_checkpoint
function, specifically in the method of handling slope updates during overlapping locked periods for the same token (_tokenId
). This involves incorrect updates toslope_changes
when bothold_locked.end
andnew_locked.end
occur at the same future time point, butnew_locked
is not an extension but potentially shortening or modification of the locked period. This issue is a logical error that leads to incorrect governance weight calculations, which fits the condition of "Manipulation of governance voting results."Attack Scenario\
Initial Setup: Assume an attacker or a regular user locks some tokens by creating an
old_locked
with a non-zero end time (old_locked.end
) that's set to some future time. Let's say theend
is set to a particular future block timestamp and they get a certain governance weight (u_old.slope
) due to this.Triggering the Vulnerability:
old_locked.end
using thenew_locked
withnew_locked.end
equal toold_locked.end
but with different parameters (e.g., reduced amount, same or less locking period than originally locked). This action is intended to change the conditions initially set withold_locked
.Incorrect Slope Adjustment:
_checkpoint
, the function neglects to correctly adjust theslope_changes
for situations wherenew_locked.end
matchesold_locked.end
but is not merely an extension (i.e., it alters parameters significantly).old_dslope -= u_new.slope;
only ifold_locked.end
doesn't matchnew_locked.end
), this leads to incorrect slope calculation where the new conditions aren't properly accounted for, maintaining higher weight erroneously.Attachments
Proof of Concept (PoC) File
Revised Code File (Optional)