Arcade.xyz - Viktor_Cortess's results

Lines of code

https://github.com/code-423n4/2023-07-arcade/blob/f8ac4e7c4fdea559b73d9dd5606f618d4e6c73cd/contracts/NFTBoostVault.sol#L363-L371

Vulnerability details

Impact

The current situation presents an issue as it is impossible to identify the addresses of users who possess specific NFT tokens locked in the contract. Consequently, if a new multiplier is lower than the previous one, a "malicious" user could exploit this loophole to avoid triggering the function updateVotingPower() and retain their previous voting power.

Proof of Concept

When the manager sets new multipliers, the _getMultipliers() function is employed to establish fresh values for particular tokens.

function setMultiplier(address tokenAddress, uint128 tokenId, uint128 multiplierValue) public override onlyManager {
    if (multiplierValue > MAX_MULTIPLIER) revert NBV_MultiplierLimit();

    NFTBoostVaultStorage.AddressUintUint storage multiplierData = _getMultipliers()[tokenAddress][tokenId];
    // set multiplier value
    multiplierData.multiplier = multiplierValue;

    emit MultiplierSet(tokenAddress, tokenId, multiplierValue);
}

Following this, someone must execute the function updateVotingPower(), which deals with user addresses.

function updateVotingPower(address[] calldata userAddresses) public override {
    if (userAddresses.length > 50) revert NBV_ArrayTooManyElements();

    for (uint256 i = 0; i < userAddresses.length; ++i) {
        NFTBoostVaultStorage.Registration storage registration = _getRegistrations()[userAddresses[i]];
        _syncVotingPower(userAddresses[i], registration);
    }
}

While the contract contains several getters, there is currently no viable method to locate users based on specific tokenIDs if updates to their voting powers are required after modifications. In the end, the user may remain unnoticed, and his votes will not be changed.

Tools Used

Tools Used

VS

Recommended Mitigation Steps

To address this issue, it is advisable to add a function to the contract that retrieves the addresses of users associated with particular token addresses and tokenIDs. By utilizing the returned addresses, the function updateVotingPower() can be promptly called immediately after setting the new multiplier. This measure will help ensure that users' voting powers are accurately updated following any changes.

Assessed type

Context