# battleElo is at risk of underflow revert, which may DOS voting

battleElo computes currentRating + eloA - 1000 without underflow guard; low-maturity services revert on valid votes with certain battle arrays, DOSing governance.

- Payout: Contest reward
- Severity: medium
- Program: Virtuals Protocol
- Credited: oakcobalt
- Disclosed: 2025-08-04
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-04-virtuals-protocol#m-21
- Library page: https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-21
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:governance

**Target:** EloCalculator.battleElo via AgentDAO.castVote
**Root cause:** battleElo returns currentRating + eloA - 1000 assuming eloA >= 1000, but negative rating changes can push eloA below 1000, causing uint256 underflow when currentRating is low.
**Steps:**
1. Deploy AgentDAO with base proposal1 executed, maturity 100.
2. Give validator1 voting power (delegate founder tokens).
3. Create proposal2 as upgrade of proposal1.
4. Call `agentDAO.connect(validator1).castVoteWithReasonAndParams(proposalId2, 1, "Good improvement", abi.encode(["uint8[] memory"], [[0,0,0,0,0,0,1,0,1,0]]))`.
5. Observe revert with Panic(0x11) arithmetic underflow.
**How found:** Code reading of battleElo's `currentRating + eloA - 1000` return; noticed ServiceNft explicitly handles `_maturities[proposalId] < _maturities[prevServiceId]`, confirming negative deltas are legitimate, then constructed a battle array producing net-negative change.
**Exploitation:** A validator submitting an honest vote with a battle array that yields net-negative elo change on a low-maturity service triggers underflow revert, blocking that vote path.
**Insight:** When a protocol explicitly handles negative deltas elsewhere (e.g. maturity decrease in updateImpact), audit arithmetic that assumes monotonic increase; craft battle arrays with more losses than wins to force eloA below its 1000 baseline.