auditsea - AdvancedDistributer - Wrong mechanism around voteFactor and voting power

[sherlock-admin]

auditsea

high

AdvancedDistributer - Wrong mechanism around voteFactor and voting power

Summary

Voting power management using voteFactor is wrong because the voteFactor can change.

Vulnerability Detail

In AdvancedDistributor, voteFactor can be set by the owner and it can be updated multiple times.
This exposes a vulnerability in claiming rewards and calculating voting power.

When voteFactor is updated to a bigger one, users will not be able to claim their rewards because burning vote tokens will revert.
When voteFactor is updated to a smaller one, users will still have their remaining voting power even after claiming all rewards.

Impact

Based on how voteFactor is changed, claiming / adjustments will not be working or users will have their voting power even though they don't have rewards to claim.

Code Snippet

https://github.com/sherlock-audit/2023-06-tokensoft/blob/main/contracts/contracts/claim/abstract/AdvancedDistributor.sol#L181-L183

https://github.com/sherlock-audit/2023-06-tokensoft/blob/main/contracts/contracts/claim/abstract/AdvancedDistributor.sol#L94

https://github.com/sherlock-audit/2023-06-tokensoft/blob/main/contracts/contracts/claim/abstract/AdvancedDistributor.sol#L120

Tool used

Manual Review

Recommendation

Either implement user-specific voting power or overwrite balanceOf function to reflect voteFactor in it.

Duplicate of #55