Snapshot delegation cannot be cleared or modified

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-asymmetry/blob/main/contracts/strategies/votium/VotiumStrategyCore.sol#L100-L111

Vulnerability details

Summary

Convex voting power is delegated to the Votium protocol when the VotiumStrategy contract is deployed and cannot be cleared or changed if required.

Impact

The Votium strategy contract earns Convex rewards by delegating its voting power to Votium. This is done using the Snapshot
protocol, when the VotingStrategy contract is deployed, it calls the Snapshot registry to register the delegation.

https://github.com/code-423n4/2023-09-asymmetry/blob/main/contracts/strategies/votium/VotiumStrategyCore.sol#L100-L111

100:     function initialize(
101:         address _owner,
102:         address _rewarder,
103:         address _manager
104:     ) external initializer {
105:         bytes32 VotiumVoteDelegationId = 0x6376782e65746800000000000000000000000000000000000000000000000000;
106:         address DelegationRegistry = 0x469788fE6E9E9681C6ebF3bF78e7Fd26Fc015446;
107:         address votiumVoteProxyAddress = 0xde1E6A7ED0ad3F61D531a8a78E83CcDdbd6E0c49;
108:         ISnapshotDelegationRegistry(DelegationRegistry).setDelegate(
109:             VotiumVoteDelegationId,
110:             votiumVoteProxyAddress
111:         );

After this registration is done, there is no current way of clearing or modifying this action. If the Snapshot id changes, or the Votium address changes, the protocol administrators won't be able to modify the delegation.

Recommendation

Add a function controlled by the owner of the protocol to modify the registration:

function setDelegation(bytes32 id, address target) external onlyOwner {
    address DelegationRegistry = 0x469788fE6E9E9681C6ebF3bF78e7Fd26Fc015446;
    ISnapshotDelegationRegistry(DelegationRegistry).setDelegate(id, target);
}

Assessed type

Other

[c4-judge]

0xleastwood marked the issue as primary issue

[0xleastwood]

I don't think this qualifies as a medium severity issue, proxy addresses do not change and the issue raised seems like a best practice that should be implemented but is not necessary. Downgrading to QA.

[c4-judge]

0xleastwood changed the severity to QA (Quality Assurance)

[c4-judge]

This previously downgraded issue has been upgraded by 0xleastwood

[c4-judge]

0xleastwood changed the severity to QA (Quality Assurance)

[c4-judge]

0xleastwood marked the issue as grade-a

[c4-sponsor]

elmutt (sponsor) confirmed

[c4-judge]

0xleastwood marked the issue as selected for report

[c4-judge]

0xleastwood removed the grade

[c4-judge]

0xleastwood marked the issue as not selected for report