veRWA - Naubit's results

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/GaugeController.sol#L210 https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/GaugeController.sol#L212

Vulnerability details

Impact

An invalid value is not being ignored but accepted even if the natspec states it should be ignored.

Proof of Concept

In the GaugeController.sol contract there is a function called vote_for_gauge_weights. The natspec of that function states that the _user_weight var value is ignored if 0 (so the function should revert) (https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/GaugeController.sol#L210C16-L210C28).

But in the require used to check exactly that condition, it is allowing the 0 value:

require(_user_weight >= 0 && _user_weight <= 10_000, "Invalid user weight");

That makes invalid the instructions from the natspec and could potentially create unexpected issues and other issues since everyone will be expecting to not have a 0 value in the _user_weightvar.

Tools Used

Manual review.

Recommended Mitigation Steps

Replace the code with:

+ require(_user_weight > 0 && _user_weight <= 10_000, "Invalid user weight");
- require(_user_weight >= 0 && _user_weight <= 10_000, "Invalid user weight");

Assessed type

Invalid Validation