User can quick vote and withdraw their vote

[code423n4]

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/GaugeController.sol#L211-L278

Vulnerability details

Impact

There's nothing which stops user to vote with his max power/weight on a gauge and then withdraw the vote. After withdrawing, his max power/weight can be re-used to vote on another gauge.

Proof of Concept

User can vote for multiple gauges till the sum of his assigned weights do not exceed 10 000:

 power_used = power_used + new_slope.power - old_slope.power;
 require(power_used >= 0 && power_used <= 10_000, "Used too much power");

The power_used calculation takes into the consideration the old vote. Thus user can decrease their vote. E.g. if user votes for gauge with weight 10, and then votes for the same gauge with weight 4, the weight will be updated to 4, and the power used will be decreased to 4.
This behavior allows user to put his all voting power (10 000) on a single gauge, then remove it and right afterwards reuse it again (10 000) on another vote.

Tools Used

Manual code review

Recommended Mitigation Steps

Do not allow to decrease assigned weight to gauge

Assessed type

Other

[c4-pre-sort]

141345 marked the issue as duplicate of #45

[c4-pre-sort]

141345 marked the issue as not a duplicate

[c4-pre-sort]

141345 marked the issue as duplicate of #77

[alcueca]

See #77

[c4-judge]

alcueca marked the issue as unsatisfactory:
Invalid