veRWA - markus_ether's results

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/GaugeController.sol#L92

Vulnerability details

Impact

Votes cast for newly added gauges are irretrievably lost. The Governance must call the change_gauge_weight method to allow any votes getting counted.

Proof of Concept

While the add_gauge function whitelists a new Gauge, it overlooks one crucial step. The core issue is that the function add_gauge does not set the time_weight of the new gauge, as the original vyper code does.

As a result, the get_weight function prematurely returns, failing to allocate any rewards. By calling change_gauge_weight, the government can finally set the time index enabling new voter to cast their votes.

Here is a POC showcasing the bug:

// prepare
vm.startPrank(gov);
gc.add_gauge(user1);
vm.deal(user1, 100 ether);
vm.stopPrank();

// issue
vm.startPrank(user1);
uint256 v = 10 ether;
ve.createLock{value: v}(v);
gc.vote_for_gauge_weights(user1, 100);

assertEq(gc.get_gauge_weight(user1), 0); // note the user voted, but had no effect

Tools Used

Manual review

Recommended Mitigation Steps

There are two potential fixes.

1. Prevent users from voting on an uninitialized Vault:

function vote_for_gauge_weights(address _gauge_addr, uint256 _user_weight) external {
+   require(time_weight[_gauge_addr] > 0, "weight must be non-zero");

2. Instantly initialize a weight of 0 for any new gauge

function add_gauge(address _gauge) external onlyGovernance {
    require(!isValidGauge[_gauge], "Gauge already exists");
    isValidGauge[_gauge] = true;
+   _change_gauge_weight(_gauge, 0);
    emit NewGauge(_gauge);
}

Assessed type

Governance

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/GaugeController.sol#L211-L213 https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/GaugeController.sol#L276-L277

Vulnerability details

Impact

Governance has the ability to modify gauge weights under emergency circumstances. However, an attacker can counteract this adjustment by recasting their vote for the gauge, hereby restoring the gauge weight.

Proof of Concept

The governance sets the weight of a malicous gauge to zero by calling change_gauge_weight. Now the attacker can reclaim their voting power by setting their voting power to zero. Then they can vote for the vault again, sidestepping the previous government action.

Here's a demonstration highlighting this vulnerability:

function testVoteExploit() public {
    // prepare
    vm.startPrank(gov);
    gc.add_gauge(user1);
    gc.change_gauge_weight(user1, 100);
    vm.deal(user1, 100 ether);
    vm.stopPrank();

    // user votes for gauge
    vm.startPrank(user1);
    uint256 v = 10 ether;
    ve.createLock{value: v}(v);
    gc.vote_for_gauge_weights(user1, 100);
    assertTrue(gc.get_gauge_weight(user1) > 100);
    vm.stopPrank();

    // government sets weights to zero
    vm.startPrank(gov);
    gc.change_gauge_weight(user1, 0);
    assertEq(gc.get_gauge_weight(user1), 0);
    vm.stopPrank();

    // user claim back voting power
    vm.startPrank(user1);
    gc.vote_for_gauge_weights(user1, 0);
    assertEq(gc.vote_user_power(user1), 0);
    
    // user gives gauge weight back
    gc.vote_for_gauge_weights(user1, 100);
    assertTrue(gc.get_gauge_weight(user1) > 0);
    vm.stopPrank();
}

Tools Used

Manual review

Recommended Mitigation Steps

To counter this exploit, it's essential to limit the number of times a user can vote in a given period. It's suggested that users are not permitted to vote more than once a week. As a point of comparison, Curve has limited users to vote once every 10 days.

A proposed code modification is:

function vote_for_gauge_weights(address _gauge_addr, uint256 _user_weight) external {
+    require(block.timestamp >= last_user_vote[msg.sender][_gauge_addr] + WEIGHT_VOTE_DELAY, "Cannot vote so often");

In this context, the WEIGHT_VOTE_DELAY should be set to span beyond one week.

Assessed type

Governance