User can keep claiming fees in the profit manager even with a loss in the gauge.

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/ProfitManager.sol#L409

Vulnerability details

Users are presented with two options to vote for a gauge: through staking credit tokens in the SurplusGuildMinter or directly in the guild token using the incrementGauge function. Users possessing guild tokens have the flexibility to decide and vote for a gauge directly, earning fees from the interest paid by borrowers.

In the event of a gauge incurring a loss, users who voted for that gauge may face slashing. However, if no one takes the necessary action to slash these users, they can continue claiming fees in the profit manager. Note that this is not the same behavior if a user stake credit in the SurplusGuildMinter.

Impact

Users can continue claiming fees in the profit manager, even in the event of a loss in the associated gauge as long as they are not slashed by anyone.

Proof of Concept

Run the next test function in file:

 function testClaimingFeesWithLosses() public {
        vm.prank(governor);
        profitManager.setProfitSharingConfig(
            0.1e18, // surplusBufferSplit
            0.8e18, // creditSplit
            0.1e18, // guildSplit
            0.0e18, // otherSplit
            address(0) // otherRecipient
        );

        _setupAliceLossInGauge1();

        uint256 Balance1 = credit.balanceOf(alice);

        credit.mint(address(profitManager), 100e18);
        profitManager.notifyPnL(gauge1, 100e18);

        vm.prank(alice);
        profitManager.claimGaugeRewards(alice, gauge1);

        vm.roll(block.number + 1);

        uint256 Balance2 = credit.balanceOf(alice);
 
        assert(Balance2 > Balance1);
    }

Tools Used

Manual, Foundry

Recommended Mitigation Steps

Consider implementing a check to determine whether a user has already applied a loss or not in cases where a gauge is slashed.

Assessed type

Other

[c4-pre-sort]

0xSorryNotSorry marked the issue as sufficient quality report

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #956

[c4-judge]

Trumpero marked the issue as duplicate of #262

[c4-judge]

Trumpero changed the severity to QA (Quality Assurance)

[c4-judge]

Trumpero marked the issue as grade-b

[c4-judge]

Trumpero marked the issue as grade-c