Submitted by xiaoming90
Per the documentation, AURA tokens can be locked in the AuraLocker to recieve vlAURA. vlAURA is voting power in the AURA ecosystem.
It is also possible for the users to delegate their voting power to a specific address by calling the AuraLocker.delegate(address account) function.
However, after users locked up their AURA tokens in exchange for vlAURA tokens, their voting power did not increase.
The following shows an example of Alice attempting to get some voting power by locking up her AURA tokens, but her voting power did not increase:
The following snippet of test script demonstrates the above issue, showing that the vote power remains the same after locking up the AURA tokens for a week.
Following is the output of the test script.
(Note: vlAURA == vlCVX and AURA == CVX in this context)
Aura Finance has implemented a checkpointing mechanism for determine users voting power. Therefore, accounting for the votes will only happen during checkpoint when AuraLocker.checkpointDelegate() function is being
called. Therefore, the AuraLocker.getVotes() function will only consider the locked AURA tokens that have been checkpointed as votes. In other words, if the locked AURA tokens have not been checkpointed yet, it will simply remain as a balance in the AuraLocker contract, and the users locked AURA tokens effectively have no voting power.
Based on the source code, the root cause of this issue is that if a user does not have a delegatee, the system will not perform any checkpointing, and users locked AURA token will not be accounted as voting power.
Following code from AuraLocker._lock() shows that checkpointing will only be performed if the user has a delegatee. Otherwise, no checkpointing will be performed when users locked their AURA tokens.
The only way for Alice could get back her voting power is to delegate to herself after locking her AURA tokens. This is a workaround. AuraLocker.delegate() sole purpose should only serve to delegate ones voting power to another user, and should not be used as a workaround to force the system to perform checkpointing to gain voting power.
For Alice to get back her voting power, she must call the AuraLocker.delegate(Alice.address) function, which will delegate to herself. This function will in turn call the AuraLocker._checkpointDelegate() function, which will checkpointed Alices locked tokens to become votes. Only after this step, Alices voting power will be updated and calling AuraLocker.getVotes(Alice.address) should return 100 now.
Additionally, documentation did not mention that a user is required to delegate to oneself in order to get the voting power. Thus, it is very likely that majority of the users would not know how to get their voting power unless they review the source code or is aware of this workaround.
The impact of this issue is that users might miss the opportunity to vote on critical protocol decisions or flow of incentives (Gauge voting) due to lack of voting power as voting power is not assigned to them after locking up AURA tokens.
If the users only realised this issue in the current epoch, they would miss the chance to vote in current epoch. This is because by calling the AuraLocker.delegate(address account) function to fix the issue, the votes will only be effective in the next epoch.
The outcome of the governance or gauge voting might be impacted and might not reflect the true consensus of the community as affected users are not able to participate in the vote or have inaccurate voting power, thus affecting the protocol.
In Convex Finance, users lock their CVX tokens by calling CvxLocker._lock() function and voting power will be allocated to the users immediately. Similar strategy should be adopted.
It is recommended to update the AuraLocker._lock() function so that the users locked AURA tokens are checkpointed and converted to voting power immediately after locking up if a user has not assigned a delegatee yet. This will trigger the accounting for votes and translate the newly locked tokens into voting power immediately.
Original Code
Suggested Modification
0xMaharishi (Aura Finance) disputed and commented:
LSDan (judge) commented:
