Arcade.xyz - sces60107's results

Lines of code

https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L363 https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L342

Vulnerability details

Impact

NFTBoostVault.setMultiplier is used to modify the multipliers. And NFTBoostVault.updateVotingPower should be called to actually update the current voting power. In other words, if no one calls NFTBoostVault.updateVotingPower for every user who registers the ERC1155 token. The current voting power could be incorrect.

Proof of Concept

NFTBoostVault.setMultiplier simply update storage of multiplierData. https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L364

    function setMultiplier(address tokenAddress, uint128 tokenId, uint128 multiplierValue) public override onlyManager {
        if (multiplierValue > MAX_MULTIPLIER) revert NBV_MultiplierLimit();

        NFTBoostVaultStorage.AddressUintUint storage multiplierData = _getMultipliers()[tokenAddress][tokenId];
        // set multiplier value
        multiplierData.multiplier = multiplierValue;

        emit MultiplierSet(tokenAddress, tokenId, multiplierValue);
    }

Someone needs to call updateVotingPower to actually update the current voting power. But it may be hard to find all the registrations which register the corresponding ERC1155 token. https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/NFTBoostVault.sol#L342

    function updateVotingPower(address[] calldata userAddresses) public override {
        if (userAddresses.length > 50) revert NBV_ArrayTooManyElements();

        for (uint256 i = 0; i < userAddresses.length; ++i) {
            NFTBoostVaultStorage.Registration storage registration = _getRegistrations()[userAddresses[i]];
            _syncVotingPower(userAddresses[i], registration);
        }
    }

If one registration is not updated, the incorrect voting power could harm the voting system.

Tools Used

Manual Review

Recommended Mitigation Steps

There should be a mapping that can help look out for the user who registers the specific ERC1155 token. Thus, updateVotingPower can easily target all the registrations that need to be updated. Moreover, setMultiplier can update the voting power with the help of the mapping.

Assessed type

Other