veRWA - ni8mare's results

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/GaugeController.sol#L204

Vulnerability details

Impact

change_gauge_weight function in the GaugeController contract can be used to update a gauge which is invalid.

Proof of Concept

The functions which are supposed to be called by the governance like add_gauge, remove_gauge check whether the gauge address in the input is valid. But, the function change_gauge_weight does not check for this validity. Due to this missing check, points_weight[_gauge][next_time].bias, time_weight[_gauge], points_sum[next_time].bias and time_sum get updated because of an invalid gauge value (where next_time = ((block.timestamp + WEEK) / WEEK) * WEEK;). Important to note that the points_sum[next_time].bias variable gets updated here.

When gauge_relative_weight is called for time = next_time, the relative weight for different valid gauges is reduced because the value points_sum[t].bias gets updated when change_gauge_weight was called previously.

    function _gauge_relative_weight(address _gauge, uint256 _time) private view returns (uint256) {
        uint256 t = (_time / WEEK) * WEEK;
        uint256 total_weight = points_sum[t].bias;
        if (total_weight > 0) {
            uint256 gauge_weight = points_weight[_gauge][t].bias;
            return (MULTIPLIER * gauge_weight) / total_weight;
        } else {
            return 0;
        }
    }

This is problematic because the inflation amount received by a gauge equals inflation_rate * relative_weight / 1e18. So, lower inflation will be received by other valid gauges because of the update made due to an invalid gauge.

Tools Used

Manual review

Recommended Mitigation Steps

In the function gauge_relative_weight, add the following check:

require(isValidGauge[_gauge], "Invalid gauge address");

Assessed type

Invalid Validation