31141 - [SC - Critical] Permanent freezing of unclaimed yield of reward...
Permanent freezing of unclaimed yield of reward tokens in Bribe contract when attackers maliciously exploit voter.poke()
Submitted on May 13th 2024 at 10:11:55 UTC by @perseverance for Boost | Alchemix
Report ID: #31141
Report type: Smart Contract
Report severity: Critical
Target: https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Bribe.sol
Impacts:
Permanent freezing of unclaimed yield
Permanent freezing of unclaimed royalties
Description
Description
Brief/Intro
Bribe contracts allow bribing users with voting power to vote for a specific gauge. The contract allows bribed users to claim their bribes.
when the function notifyRewardAmount() is called, the reward token is sent from the msg.sender to bribe contract and kept in this contract as reward.
https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Bribe.sol#L112
Holders of VeAlcx tokens after voting in Voter contract will earn some reward and can claim reward by calling function claimBribes in voter contract.
https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Voter.sol#L332-L338
Reward is calculated as follow:
https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Bribe.sol#L283C5-L300C6
The earned() internal function is used to calculate the reward for a user.
https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Bribe.sol#L265-L278
The _priorSupply is taken from votingCheckpoints[].votes. This votes are updated whenever the deposit function into Bribe is called when user vote via Voter contract.
https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Bribe.sol#L306C8-L316C6
_writeVotingCheckpoint() is called.
https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Bribe.sol#L362-L372
The vulnerability
Vulnerability Details
With that basic understanding, I will explain the Vulnerability now.
The vulnerability is that when user deposit() by calling vote() function via Voter contract, then the _writeVotingCheckpoint() is called. Then the votingCheckpoints[].votes is updated to be the totalVoting. In the function deposit, the totalVoting is increased. But in function withdraw() the totalVoting is not decreasing.
https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Bribe.sol#L309