VoterProxy incorrectly assumes a 1-1 mapping between the gauge and the LP tokens.

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VoterProxy.sol#L270
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VoterProxy.sol#L140

Vulnerability details

Impact

When calling withdrawAll, to compute the amount to withdraw, the contract checks the balance of gauge tokens and assume that 1 gauge token = 1 LP token by doing uint256 amount = balanceOfPool(_gauge).add(IERC20(_token).balanceOf(address(this)));. Overall this assumption may not hold and this would lead to a loss of funds when calling withdrawAll.

Proof of concept

Indeed this is false in some cases, check for example https://etherscan.io/address/0x3785Ce82be62a342052b9E5431e9D3a839cfB581 where the total supply is not the same as the balance of LP tokens held by the contract. You can also check the contract code where you can see there is a staking_factor between the balance and the underlying LP token balance.

Mitigation steps

Use the total supply of pool.token which is a better proxy to know how much to withdraw when withdrawing all.

[jetbrain10]

are you refering we need to calc the staking _factor by ourself?

[GalloDaSballo]

@jetbrain10 the warden says that some Deposits will not return the same amount of Lp Tokens.

See this example from the contract linked by the Warden:
https://etherscan.io/tx/0xd3eab573697d4fb92ebe4d91d35b03795d384ac45f7a723b321c98f6da2420cb

[GalloDaSballo]

I think this means the contracts may break when integrating with Angle Protocol.

AfaI'm aware CRV, Balancer will return a 1-1 between the Deposit Token and the Gauge Token

[GalloDaSballo]

The warden has shown evidence of the GaugeLP-Token being "rebased" from the "usual" 1-1 to a ratio (assuming due to cost / increasing in value in underlying).

Because:

• The Sponsor system is meant to integrate with multiple protocols
• The warden has shown a specific example (ANGLE) of the math bring broken

Considering that this is contingent on the sponsor launching an integration with the Angle Protocol, using Gauges that "rebase", I believe the finding to be Valid and of Medium Severity

Most likely remediation will require poking the gauge for exchange rates and also checking available tokens after withdrawing

[liveactionllama]

Per discussion with @jetbrain10 (sponsor), adding sponsor acknowledged label to this issue.