30919 - [SC - Critical] Front running of pokeTokens could lead to loss ...
Submitted on May 8th 2024 at 04:39:00 UTC by @jecikpo for Boost | Alchemix
Report ID: #30919
Report type: Smart Contract
Report severity: Critical
Target: https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Voter.sol
Impacts:
Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
Description
Brief/Intro
The Voter.pokeTokens()
allows an admin to vote on behalf of any veALCX token owner for a given set of gauges. It is assumed that the purpose of the function is to provide automated regular voting services by the Alchemix system. The pokeTokens()
does not check if the user already voted in the current Epoch. If the user did vote already, the next vote on the same epoch will affect the bribe accounting and diminish the bribes for all voters of the given gauge(s).
Vulnerability Details
The Voter.pokeToken()
calls poke()
for each tokenId specificed. poke()
calls _vote()
which issues the vote to the given gauges. For each gauge specified Bribe.deposit()
is called. deposit()
increases (among other things): totalSupply
and totalVoting
. Those variables are then checkpointed and used when earned bribes are beeing calculated at earned()
.
A malicious user can orchestrate a griefing attack, by front-running the pokeTokens()
call. This will inflate the totalVoting
which will diminish the amounts received by all users entitled to bribe claiming.
Impact Details
The bribes of all users on a given gauge will be diminished by proportional amount of the malicious user extra voting power.
References
https://github.com/alchemix-finance/alchemix-v2-dao/blob/f1007439ad3a32e412468c4c42f62f676822dc1f/src/Voter.sol#L215
Proof of Concept
Copy the following code to the Voting.t.sol
: