veRWA - mert_eren's results

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/LendingLedger.sol#L129-L143

Vulnerability details

Impact

Lending lenger give reward tokens to users if they lend their tokens to selected pools. Lendingledger give rewards as weekly and it records user's balance until end of the week(espacially thursday because 1 jan 1970 was thursday). But protocol records can be any record in the week anyvalue, protocol just look at the latest updated value in this week . In short a user can withdraw his tokens after thursday but if he stake his token before next thursday 00.00 he will benefit from tokens like stake tokens all week.

Proof of Concept

https://imgur.com/a/qIrEoOa pls paste this test to lendingLEdgerTest.sol and it can be seen that a malicious user can take same reward like all time staker when just stake his token just for two block time.

Tools Used

Recommended Mitigation Steps

Assessed type

Invalid Validation

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/VotingEscrow.sol#L390-L409 https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/GaugeController.sol#L215-L220

Vulnerability details

Impact

When vote_for_gauge_weights() used contract just take info of users slope of exact time. And there is no extra check mechanism in protocol for control is user's delegate amount (so slope too) until user use vote_for_gauge_weights(). So a user can use vote_for_gauge_weights for one account than delegate another contract to his vote power in voteEscrow and use vote_for_gauge_weights() again (he can use this exploit as much as he want) so he can manipulate vote power as a sybil attack.

Proof of Concept

https://imgur.com/a/WEuU1RN pls paste this test to gaugeControllertest.sol and it can be seen that how significantly increased of gauge1 by sybil attack.

Tools Used

Recommended Mitigation Steps

Use vote_for_gauge_weights() in voteescrow for msg.sender when delegate function used.

Assessed type

Governance

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/VotingEscrow.sol#L331 https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/VotingEscrow.sol#L383

Vulnerability details

Impact

tokens will be stuck forever if user's locktime expired when his delegatee someone differant than him. Because he cannot withdraw his money also he cannot delegate himself too because his lock expired.Also he cannot use increaseamount for lockexpired and createLock too due to lock.amount>0. so his tokens will be stuck forever.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Recommended Mitigation Steps

Can be add extra function for delegate himself when lock.expired and making special checkpoint station can be good.

Assessed type

DoS

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/GaugeController.sol#L210-L213 https://github.com/code-423n4/2023-08-verwa/blob/498a3004d577c8c5d0c71bff99ea3a7907b5ec23/src/GaugeController.sol#L127-L130

Vulnerability details

Impact

When gov use removeGauge gauge's power changed to the 0, however there is no reset for user votePower which stored in vote_user_power mapping. Because of that users will lose their voting power. For example if a user give his 1000 votingPower to removedGauge before removed.His votingpower reduced to 9000(normally everyone's is 10000).Also he cannot decreased votingpower for removedGauge because there is no chance to use vote_user_power for removed gauge.( vote_user_power is the only function for reduce of user's vote power to gauge.)

Proof of Concept

https://imgur.com/a/sRgCApg pls paste this test to gaugeControllerTest.sol and from test it can be seen that user cannot take his voting power back and his votingPower stuck for nothing

Tools Used

Recommended Mitigation Steps

Assessed type

Invalid Validation