31539 - [SC - Medium] The Voterdistribute function can continue to fail
Submitted on May 21st 2024 at 04:16:06 UTC by @cryptoticky for Boost | Alchemix
Report ID: #31539
Report type: Smart Contract
Report severity: Medium
Target: https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/Voter.sol
Impacts:
Protocol insolvency
Unbounded gas consumption
Description
Brief/Intro
When calling the Voter.distribute function, the distribution for some gauges can fail for a number of reasons and the transaction would be failed.
Therefore, it is not appropriate to distribute while circulating all the gauges. In addition, as the number of gauges increases, gas costs can exceed blockGasLimit in the worst case. This can cause the protocol to stop.
Vulnerability Details
1. Failure due to some conditional statements
This is not about the gauge that the attacker artificially adds. This is a problem that can occur in already existing gates
If proposalUpdated is false, the distribute function is failed. So the admin must call the updateProposal function before call distribution function at start time of every epoch. However, there may be situations where you should not update the proposal in some gauges Then, you will not be able to distribute all the gages because of this gauge.
2. Failure by operation beyond block gas limit
Treating too many gates into one loop may exceed blockGasLimit.
Impact Details
The Voter.distribute function can continue to fail and the protocol may be stopped. If tx fails, the corresponding gas cost will be lost. If the protocol has 100 gauges and successfully run up to 99 but fail to run on the last 100th gauge, you lose significant gas costs.
Recommendation
Add these functions in Voter.sol
I want you to look at the problems in this report precisely and carefully. This is a problem that often happens in real life.
Thank you.
Proof of Concept
Last updated