Increase voting power by tokenizing the address that locks the token

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/contracts/AuraLocker.sol#L258-L295

Vulnerability details

Impact

Without restriction on the type of address that lock the token, a bad actor could lock the token through the smart contract. Doing so enable him to make the lockedToken becomes liquidate by tokenize his smart contract which defeat the purpose of the lockedToken that is supposed to be untransferable. Moreover, a bad actor could attract people to lock the token through his smart contract instead of directly locking with AuraLocker by injecting better short-term incentives to his wrapper token. This enable the bad actor to accumulate voting power that could dictate the future of the protocol.

Proof of Concept

-A bad actor creates a smart contract
-A contract calls lock in AuraLocker and locks the token
-A bad actor tokenizes the contract
-A bad actor attracts people to lock the token through his smart contract by offering a wrapper tokens or additional incentives like high apy etc.
-A bad actor dictates the smart contract to delegate its vote to his preferred address.

Recommended Mitigation Steps

It would be best to check whether the locker is the smart contract or the wallet and, if the protocol wants the smart contract to be the locker, it can implement the whitelist or blacklist.

[0xMaharishi]

Given no user funds are at risk I don't think this is a super high risk, but i do agree that there is a governance risk there and it's something to be concerned about if/when there is no multisig intermediary between aura voters and execution. With that being said, I think a good solution would be to have a blacklist that the owner can set to block non-eoa's from making any further locks: bool canLock = isEOA(address) || !isBlacklisted(address)

[0xMaharishi]

code-423n4/2022-05-aura#6

[dmvt]

I'll leave this in place as a medium risk because there are external factors involved. High risk is too severe.