# Voters from VotingEscrow can vote infinite times in vote_for_gauge_weights() of GaugeController

VotingEscrow delegation lets a voter re-vote gauge weights repeatedly via fresh delegate addresses, inflating a gauge's weight and LendingLedger rewards.

- Payout: Contest reward
- Severity: high
- Program: Canto
- Credited: 0x73696d616f
- Disclosed: 2023-10-11
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-08-verwa-findings/issues/396
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** GaugeController.vote_for_gauge_weights / VotingEscrow delegate
**Root cause:** vote_for_gauge_weights reads current voting power and does not track per-gauge vote history per delegate, so delegating to a fresh address grants a new unvoted voting slot each time.
**Steps:**
1. Lock tokens in VotingEscrow via `createLock`
2. Call `gc.vote_for_gauge_weights(gauge, 10000)` from voter
3. Call `ve.delegate(fakeUser)` to a fresh address holding a minimal lock
4. Call `gc.vote_for_gauge_weights(gauge, 10000)` from fakeUser
5. Repeat with new fake addresses to multiply gauge weight
**How found:** Code reading of VotingEscrow delegate mechanism combined with GaugeController's per-call voting power fetch; noticed no per-gauge vote tracking across delegates.
**Exploitation:** Attacker votes, delegates to many fresh addresses each with a 1 wei lock, and re-votes from each delegate, multiplying the gauge's weight ~20x in the PoC; inflated weight then yields excess token claims in LendingLedger for that market.
**Escalation:** Scale by creating arbitrarily many delegate addresses; weight grows linearly with delegate count.
**Insight:** When a voting/governance contract reads live voting power and allows delegation, check whether a delegate can re-cast votes for the same gauge—vote history must be keyed to the underlying locked position, not the caller address.