pashap9990 - Cash token will be locked in epoch if no power token holder join to vote epoch

[sherlock-admin3]

pashap9990

medium

Cash token will be locked in epoch if no power token holder join to vote epoch

Summary

Lets assume Alice has 10 percent of power token and in first epoch she doesn't participate in vote epoch part actually Alice's balance is 1000 power token because of this she loses 10 percent of his balance and that goes to dutch auction in next epoch ,Bob buys Alice's power tokens for 1 WETH in second epoch ,already we have 1 WETH in second epoch , also no power token holder participate in vote phase in second epoch and we call distribute function for distribute cash tokens between holders, because of this any zero token doesn't mint in third epoch because we don't have voter in second epoch and because of this anybody cannot claim Bob's cash tokens

Vulnerability Detail

please add this function in ttg/test/DistributionVault.sol

function test_distributionWithZeroSupply() external {
        // Sets account balances this epoch.
        _baseToken.setPastBalanceOf(_accounts[0], _currentEpoch() - 1, 1_000_000);
        _baseToken.setPastTotalSupply(_currentEpoch() - 1, 1_000_000);

        _baseToken.setPastBalanceOf(_accounts[0], _currentEpoch(), 0);
        _baseToken.setPastTotalSupply(_currentEpoch(), 0);

        // Mint 1_000_000 funds tokens to the ZeroToken contract and distribute them.
        _token1.setBalance(address(_vault), 1_000_000);
        _vault.distribute(address(_token1));

        uint256 startEpoch_ = _currentEpoch();
        uint256 endEpoch_ = startEpoch_;

        _warpToNextEpoch();
        assertEq(_vault.getClaimable(address(_token1), _accounts[0], startEpoch_, endEpoch_), 0);

    }

Impact

Cash token will be locked in epoch if no power token holder join to vote epoch

Code Snippet

https://github.com/sherlock-audit/2023-10-mzero/blob/main/ttg/src/DistributionVault.sol#L215

Tool used

Manual Review

Recommendation

I think we can add a function to standard governor that can move cash tokens from an epoch to another epoch

[deluca-mike]

I don't think this is a duplicate of #21.

In any case, I believe this is invalid, because:

• the way it is worded it doesn't really make sense
• participating in voting during an epoch has nothing to do with getting a distribution from the vault