ZanyBonzy - change_gauge_weight can be front ran to gain extra voting power

[sherlock-admin2]

ZanyBonzy

medium

change_gauge_weight can be front ran to gain extra voting power

Summary

Users can front-run calls to the change_gauge_weight and gain extra voting power.

Vulnerability Detail

In a case where the admin decides to increase/decrease gauge weight, a user actively monitoring the mempool can front run the call. He can remove his votes from the gauge, reducing the weight prior to the admin changing gauge weight. Once admin changes gauge weight, the user then votes for the gauge, increasing the gauge weight to more than was expected to be.

• Alice has a gauge and has contributed for 1000 weight;
• She notices the admin calling change_gauge_weight function with a value of 500 weight;
• She frontruns the call, and removes all of her weight. The gauge weight is now 0;
• The admin's function gets executed and the gauge weight is now 500;
• Alice votes once again for the gauge with the same 1000 weight. The total gauge weight is now 1500, 1000 more than the admin had planned.

Impact

Code Snippet

https://github.com/sherlock-audit/2023-11-convergence/blob/e894be3e36614a385cf409dc7e278d5b8f16d6f2/sherlock-cvg/contracts/Locking/GaugeController.vy#L593

Tool used

Manual Review

Recommendation

Use increase/decrease methods to change weight instead of a set value.

Duplicate of #122