Open hats-bug-reporter[bot] opened 1 month ago
Gauges can only be created by the governance
@0xmahdirostami Yes, that is correct. However, the implementation lacks validation checks to verify that the gauge addresses passed as parameters during the function invocation correspond to the addresses of gauges created by the governance contract
Github username: @rilwan99 Twitter username: Ril11111 Submission hash (on-chain): 0xb7c7921d6fccefede3cb8225755ae8f4f087b34c654ae953d85bf28d04e66f08 Severity: medium
Description: Description\ The BaseManagedNFTStrategyUpgradeable.sol contract contains
claimRewards(address[] calldata gauges_)
that allows any user to claim rewards earned by the strategy from gauges. This function is marked as external, making it publicly accessible.This function invokes
claimRewards
from VoterUpgradeableV1_2.sol:The implementation allows arbitrary addresses to be passed as gauges, which are then called without validation. This creates a potential vector for Denial of Service (DoS) attacks.
Attack Scenario\
claimRewards()
onBaseManagedNFTStrategyUpgradeable.sol
, passing an array containing addresses of contracts that implement a maliciousgetRewards()
function. This function could be designed to consume excessive gas (e.g., through an infinite loop), causing the transaction to run out of gas and fail.getRewards()
function. By passing a large array of these addresses toclaimRewards()
, they could cause the transaction to run out of gas due to the unchecked loop inVoterUpgradeable.sol
.Impact
Successful exploitation could render the
claimRewards()
function in BaseManagedNFTStrategyUpgradeable.sol unusable, preventing legitimate users from claiming their rewards and disrupting the normal operation of the protocol.Attachments
The following methods could be used to mitigate this vulnerability:
Implement strict access control on the claimRewards function. Only allow trusted addresses or roles to call this function.
Maintain a whitelist of valid gauge addresses. Check each address against this whitelist before calling
getReward()