Submitted by adriro, also found by rvierdiiev
The reward system in VotiumStrategy can be potentially gamed by users to enter just before rewards are deposited and request an exit after that. Depending on the withdrawal queue, users may exit as early as the next epoch and avoid waiting the normal 16 weeks of vote locked CVX.
Voting in the Convex protocol requires a commitment of at least 16 weeks. Holders of CVX tokens can lock their tokens into vlCVX, which grants them voting power in Curve gauges.
The same mechanism is applied internally in the VotiumStrategy contract. Deposited ETH is swapped to CVX and locked for vlCVX. Withdrawals are executed in a queued fashion, by reserving tokens that will eventually expire in coming epochs. A user exiting the strategy may have enough tokens to exit their position as early as the next epoch.
This means that, under the right circumstances, a user may deposit in VotiumStrategy and withdraw from it in a short period of time. The user just needs to have available expirable tokens coming from previous deposits in the platform, not necessarily related to the ones coming from their deposit. This can potentially reduce the commitment, requiring much less time than the required 16 weeks when using Convex directly.
This would allow users to game the system and enter the protocol just to collect the rewards, with a minimal commitment in the platform.
Lets say an attacker is anticipating the claiming of rewards in VotiumStrategy, and lets assume also that there are enough tokens that will be expiring in the next epoch to sufficiently cover their position.
This is a variation of a common attack in vaults that compound rewards, present in different yield protocols. The usual mitigation is to introduce some delay or penalty to avoid bad intentionally users from depositing just to earn the rewards and leave.
In this case, two possible solutions are:
elmutt (Asymmetry) confirmed
Asymmetry mitigated:
Status: Unmitigated. Full details in reports from d3e4, m_Rassska, and adriro, and also included in the Mitigation Review section below.
