Velodrome Finance contest - codexploder's results

Lines of code

https://github.com/code-423n4/2022-05-velodrome/blob/main/contracts/contracts/Gauge.sol#L558

Vulnerability details

Impact

Before changing any balance _updateRewardForAllTokens should always be called, otherwise rewards will be messed. This is done correctly in withdraw function but is missing in withdrawToken function

Proof of Concept

1. User calls withdrawToken function

2. The balances are directly updated and _updateRewardForAllTokens is never called

3. This means rewards will be calculated next with incorrect balances

Recommended Mitigation Steps

The withdrawToken function should be revised to have update reward call in starting before impacting any balance

function withdrawToken(uint amount, uint tokenId) public lock {
_updateRewardForAllTokens();
...
}