Decayed voting power can be restored by delegating to newer lock

Lines of code Vulnerability details Impact Delegation to newer lock updates slope and bias of delegatee according to new delegated amount and lengthier lock time which leads to decayed voting power from delegator older lock to be restored // @audit - slope and bias being updated according to...

Delegation empowers more voting weight than expected

Lines of code Vulnerability details Description and Impact The user's voting power decreases linearly from the moment of the lock. To prevent this decrease, users can delegate their voting power to a new wallet. Here is an example scenario illustrating this: 1. The user owns two wallets, Wallet A...

faulty users can abuse the function delegate in NFTBoostVault.sol

Lines of code Vulnerability details Impact The contract NFTBoostVault.sol lets users to register their tokens/optional NFT's in exchange of voting power. in this contract its mandatory for users to be registered in order to lock their tokens and claim voting power, as its mentioned in the code...

voting power is insufficiently tracked

Lines of code Vulnerability details Impact Historical balance tracking of votingPower is not stored due to values being updated in memory rather than storage. This means old delegatees may retain voting power which should have been removed from them, new delegatees may not not receive their...

Voting can fail in early stage of voting in case of voter's voting power increase .

Lines of code Vulnerability details Impact Voting may fail in early stage of voting in case of voter's voting power increase . Proof of Concept In CoreVoting.sol , in terms of voting again the logic in vote function looks like this : // if a user has already voted, undo their previous vote. //...

loss of user funds in ARCDVestingVault.sol

Lines of code Vulnerability details Impact In the contract ARCDVestingVault.sol the function delegate is used to delegate user votes to desired address but it fails to maintain the sanity check if the provided address is a zeroaddress or not function delegateaddress to external...

User can be assigned voting power without locking tokens

Lines of code Vulnerability details Impact Using can avoid locking their tokens when adding tokens to an existing registration by calling addTokens.... Proof of Concept A malicious user can steal funds when adding tokens to an existing registration. This owing to the early return in the...

It's possible to block some user from voting for (or against) some proposal

Lines of code Vulnerability details Note: Although some code involved is inside a contract which is out of scope, I argue that this finding is in scope, since the vulnerability exists in the in-scope contract. In the Arcade protocol, there are several voting vaults implemented so that users can u...

Users' registration amounts and contract balance state will be incremented incorrectly if the NFTBoostVault::_lockTokens() silently fails

Lines of code Vulnerability details Users can add and lock tokens to the NFTBoostVault contract to increase their voting power using addTokens function. This function will increment the contract's balance state and the user's registration.amount. Then, it will sync the voting power according to t...

User can drain all locked tokens during withdrawal and still retain their voting power

Lines of code Vulnerability details Impact In the NFTBaseVault.sol contract, a user can decide to withdraw all locked tokens by calling the withdraw... function until all locked funds are drained and the still retain their voting power. Proof of Concept if a user malicious or not decides not to...

IF FEE ON TRANSFER TOKEN CONFIGURED AS THE VOTING TOKEN FOR THE VAULT, IT COULD INTRODUCE ACCOUNTING ERROR FOR VOTE COUNT

Lines of code Vulnerability details Impact The NFTBoostVault.lockTokens function is used to transfer the ERC20 voting token of the vault and the ERC1155 NFT to the NFTBoostVault contract after accounting for their respective votes. The issue here is that a fee-on-transfer token could get selected...

Reverts when a User claims Voting Power of address(0) where there exists some for address(0)

Lines of code Vulnerability details Impact There is no zero address check in the delegate function in ARCDVestingVault contract. This allows address0 to be able to accumulate VotingPower. Now when there is a some Voting Power for address0, any user can delegate themselves for address0 and claim...

User able to steal all votes escrowed in LockingVault due to downcasting

Lines of code Vulnerability details Even though the LockingVault is considered out of scope, it contains very serious vulnerability allowing anyone to steal ALL Arcade voting tokens. The vulnerability is possible due to downcasting amount to withdraw to uint96. In case that the amount of tokens...

If a lower multiplier for a particular NFT was set the owner of this NFT can avoid syncing votes with new values.

Lines of code Vulnerability details Impact The current situation presents an issue as it is impossible to identify the addresses of users who possess specific NFT tokens locked in the contract. Consequently, if a new multiplier is lower than the previous one, a "malicious" user could exploit this...

ARCDVestingVault._syncVotingPower could revert if newVotingPower is big enough.

Lines of code Vulnerability details Impact ARCDVestingVault.syncVotingPower calculate the change in voting power using int256newVotingPower - int256grant.latestVotingPower. If newVotingPower is greater than typeint256.max, ARCDVestingVault.syncVotingPower could revert. Proof of Concept...

User can delegate to address(0) in ARCDVestingVault thereby increasing address(0) VotingPower

Lines of code Vulnerability details Impact There is no zero address check in the delegate function in ARCDVestingVault contract. This allows address0 to be able to accumulate VotingPower. Proof of Concept 1. In ARCDVestingVault.delegate, Alice calls the function with voting Power 100e18 and...

Manager can delete any users voting power

Lines of code Vulnerability details Impact A manager can maliciously/accidentally remove all voting power for all users due to missing input validation when setting the multiplier value. By setting a value smaller than 1e3 it will result in all multiplier calculations rounding to 0, causing loss ...

a user can not change there vote and will cause to revert when trying due to uninitialized enum

Lines of code Vulnerability details Impact in CoreVoting.vote if you are voting again or changing direction firstly it will subtract the previous vote amount of votes but when doing that it is using uninitialized enum castBallot which by default return 0 yes enum to subtract from if...

Proposal cannot be executed if signers update their accounts and threshold halfway

Lines of code Vulnerability details Impact If signers update their accounts and threshold halfway into voting, then the proposal cannot be executed anymore Proof of Concept execute is protected under onlySigners function execute address target, bytes calldata callData, uint256 nativeValue -...

Voter/caller's eth will be stuck in contracts if the proposal fails to pass

Lines of code Vulnerability details Impact Voters of AxelarServiceGovernance.sol:executeMultisigProposal or callers of Multisig.sol:execute will have their eth stuck in the contract if they can't make the proposal/call pass the vote count checks in onlySigners. Proof of Concept...