Revolution Protocol - 0xHelium's results

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/CultureIndex.sol#L234 https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/CultureIndex.sol#L226 https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/CultureIndex.sol#L284

Vulnerability details

Impact

newPiece.quorumVotes can round down to zero when creating new piece in case totalSupply is very low; effect is CultureIndex.dropTopVotedPiece can drop a piece without meeting quorum vote

Proof of Concept

New piece quroum vote can be zero because there is a possibility of rounding down to zero in case totalsupply is very low or zero( In the early stages) as seen in this line https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/CultureIndex.sol#L234 qorum votes is calculated using this formula newPiece.quorumVotes = (quorumVotesBPS * newPiece.totalVotesSupply) / 10_000;

and totalVotesSupply is calculated using this code https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/CultureIndex.sol#L226 newPiece.totalVotesSupply = _calculateVoteWeight( erc20VotingToken.totalSupply(), erc721VotingToken.totalSupply() );

and _calculateVoteWeight() function is calculated using this code https://github.com/code-423n4/2023-12-revolutionprotocol/blob/d42cc62b873a1b2b44f57310f9d4bbfdd875e8d6/packages/revolution/src/CultureIndex.sol#L284 function _calculateVoteWeight(uint256 erc20Balance, uint256 erc721Balance) internal view returns (uint256) { return erc20Balance + (erc721Balance * erc721VotingTokenWeight * 1e18); }

So in the early stages when erc20VotingToken.totalSupply() and erc721VotingToken.totalSupply() are very low or zero _calculateVoteWeight() can return 0 or a very low uint Following , newPiece.quorumVotes = (quorumVotesBPS * newPiece.totalVotesSupply) / 10_000; could also return 0 due to some rounding down, of course setting quorumVotesBPS very high can orevent this only in case newPiece.totalVotesSupply is not 0, in case it's 0 newPiece.quorumVotes will be 0.

• verbToken ca, effectively drop a top voted piece that did not match quorum vote because it's basically 0 now
• verbToken will get minted just like that.

Tools Used

Manual review

Recommended Mitigation Steps

DAO can mint some tokens in the early stage to increase for the treasury to prevent rounding down.

Assessed type

Error