Arcade.xyz - 0xmuxyz's results

Lines of code

https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L579-L599 https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L114-L126 https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L182-L212

Vulnerability details

Impact

The NFTBoostVault#_syncVotingPower() would not be called in the following functions despite it is supposed to be called:

• NFTBoostVault#addNftAndDelegate()
• NFTBoostVault#delegate()

The voting power of the userAddresses, who call these functions above, are not updated unless someone call the NFTBoostVault#updateVotingPower(). If anyone will not call the NFTBoostVault#updateVotingPower() for a long time, the voting power of the userAddresses, who call these functions (NFTBoostVault#addNftAndDelegate() and NFTBoostVault#delegate()) above, may not be increased for a long time. This means that the voting power of these userAddresses may not be multiplied for a long time until the NFTBoostVault#updateVotingPower() would be called.

Proof of Concept

The NFTBoostVault#_syncVotingPower() is the function, which is used for updating a delegatee's voting power like this: https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L579-L599

    /**
     * @dev Helper to update a delegatee's voting power.
     *
     * @param who                        The address who's voting power we need to sync.
     *
     * @param registration               The storage pointer to the registration of that user.
     */
    function _syncVotingPower(address who, NFTBoostVaultStorage.Registration storage registration) internal {
        History.HistoricalBalances memory votingPower = _votingPower();
        uint256 delegateeVotes = votingPower.loadTop(registration.delegatee);

        uint256 newVotingPower = _currentVotingPower(registration);
        // get the change in voting power. Negative if the voting power is reduced
        int256 change = int256(newVotingPower) - int256(uint256(registration.latestVotingPower));

        // do nothing if there is no change
        if (change == 0) return;
        if (change > 0) {
            votingPower.push(registration.delegatee, delegateeVotes + uint256(change));
        } else {
            // if the change is negative, we multiply by -1 to avoid underflow when casting
            votingPower.push(registration.delegatee, delegateeVotes - uint256(change * -1));
        }

        registration.latestVotingPower = uint128(newVotingPower);

        emit VoteChange(who, registration.delegatee, change);
    }

The NFTBoostVault#_syncVotingPower() above would be called in the following functions:

• NFTBoostVault#addTokens() https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L283

• NFTBoostVault#withdraw() https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L244

• NFTBoostVault#withdrawNft() (by calling the NFTBoostVault#_withdrawNft()) https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L294 https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L569

• NFTBoostVault#updateNft() https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L329

• NFTBoostVault#updateVotingPower() https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L347

However, the NFTBoostVault#_syncVotingPower() above would not be called in the following functions despite it is supposed to be called:

• NFTBoostVault#addNftAndDelegate() https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L114-L126

• NFTBoostVault#delegate() https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L182-L212

The voting power of the userAddresses, who call these functions above, are not updated unless someone call the NFTBoostVault#updateVotingPower(). If anyone will not call the NFTBoostVault#updateVotingPower() for a long time, the voting power of the userAddresses, who call these functions (NFTBoostVault#addNftAndDelegate() and NFTBoostVault#delegate()) above, may not be increased for a long time. This means that the voting power of these userAddresses may not be multiplied for a long time until the NFTBoostVault#updateVotingPower() would be called.

Tools Used

• Foundry

Recommended Mitigation Steps

Within the NFTBoostVault#addNftAndDelegate() and the NFTBoostVault#delegate(), consider adding the NFTBoostVault#_syncVotingPower().

Assessed type

Other