Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`BaseGauge::_applyBoost` Will Always Revert With Default `boostState.minBoost`

0xdarko

Summary

BaseGauge sets boostState.minBoost to a non-bps value which in the constructor which makes it greater than the boostState.maxBoost since maxBoost is set properly in BPS format.

Vulnerability Details

[](https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/gauges/BaseGauge.sol#L142)

Inside the constructor of BaseGauge we set boostState.minBoost to 1e18, which is not in BPS format compared to maxBoost which is 25000 properly to represent 2.5%

// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
// @audit - this should be in BPS format 10_000 (1x)
@> boostState.minBoost = 1e18;

[](https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/gauges/BaseGauge.sol#L246C1-L250C11)

When functions are called that require max > min it will underflow and revert like how when we call below:

function _applyBoost(address account, uint256 baseWeight) internal view virtual returns (uint256) {
....
uint256 boost = BoostCalculator.calculateBoost(
veBalance,
totalVeSupply,
params
);
...
}

_applyBoost will always revert because of the following line in BoostCalculator::calculateBoost:

function calculateBoost(
uint256 veBalance,
uint256 totalVeSupply,
BoostParameters memory params
) internal pure returns (uint256) {
// Return base boost (1x = 10000 basis points) if no voting power
if (totalVeSupply == 0) {
return params.minBoost;
}
​
// Calculate voting power ratio with higher precision
uint256 votingPowerRatio = (veBalance * 1e18) / totalVeSupply;
// Calculate boost within min-max range
// @audit - `maxBoost` is < `minBoost` which will revert from underflowing everytime
@> uint256 boostRange = params.maxBoost - params.minBoost;
....
}

Impact

  • Core gauge functionality is completely broken as boost calculations will always revert

  • The gauge system wont be able to apply boosts until setBoostParameters is called to change minBoost

Tools Used

Foundry

Recommendations

Fix the `minBoost` in the constructor to be in BPS format:
// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
- boostState.minBoost = 1e18;
+- boostState.minBoost = 10000;
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

boostState.minBoost is set to 1e18

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.