Security Audit Report

Finding 5 (Governor execute() allows Defeated/Expired proposals) combines with Finding 16 (BlackGovernor uses block.number-1 as timestamp for proposal threshold). The misconfigured proposal threshold check may allow a proposer with minimal voting power to create proposals. Once a proposal is created and voted down by the community, the execute() logic error permits the attacker to execute it anyway. Together, the attacker can bypass both the proposal creation threshold and the voting outcome requirement to force arbitrary governance actions.

Finding 9 (GaugeFactoryCL.createGauge has no access control) enables any attacker to call createGauge, which internally triggers createEternalFarming (Finding 11). createEternalFarming calls safeApprove for 1e10 reward tokens and transfers them to an attacker-controlled farming address if the farmingParam has been set to a malicious contract by a compromised GaugeAdmin (Finding 3). The attacker can repeatedly create gauges to drain the factory's token balance or any token allowance granted to the factory.

Finding 36 (AutoVotingEscrow.lockOwner returns wrong owner for unregistered tokens due to default index 0) combines with Finding 34 (releaseLock does not verify tokenId exists before using tokenIdIndex). An attacker or a logic bug in the manager can pass an unregistered tokenId to releaseLock, which defaults to index 0 and deletes the first registered lock. The corrupted lockOwner lookup then returns the wrong owner, potentially allowing unauthorized token release via disableAutoVoting in the manager.

Finding 1 and Finding 17 both describe the same underlying rewardRate shadow variable bug in GaugeCL.notifyRewardAmount, causing the storage rewardRate to remain at 0. Finding 22 (uint256 to uint128 truncation) then silently truncates large reward values before passing them to the farming contract. Together, the accounting layer reports zero reward rate while simultaneously passing potentially truncated reward amounts to the farming pool, causing LP rewards to be calculated and distributed incorrectly across every epoch.