Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Token Transfer in Gauge Reward Distribution

aksoy

Summary

The GaugeController contract is responsible for distributing rewards to gauges. However, no actual token transfer occurs when rewards are distributed. The distributeRewards and notifyRewardAmount functions only update reward rates without transferring tokens, leading to a situation where gauges do not receive any tokens despite being assigned rewards.

Vulnerability Details

distributeRewards and distributeRevenue calculates a reward amount and notifies the gauge. However, it does not transfer the actual tokens to the gauge, meaning the reward remains within the controller.

function distributeRewards(
address gauge
) external override nonReentrant whenNotPaused {
if (!isGauge(gauge)) revert GaugeNotFound();
if (!gauges[gauge].isActive) revert GaugeNotActive();
uint256 reward = _calculateReward(gauge);
if (reward == 0) return;
IGauge(gauge).notifyRewardAmount(reward);
emit RewardDistributed(gauge, msg.sender, reward);
}

When a gauge receives a reward notification, this only updates reward rate parameters and does not transfer tokens from the controller to the gauge contract.

function notifyRewardAmount(uint256 amount) external override onlyController updateReward(address(0)) {
if (amount > periodState.emission) revert RewardCapExceeded();
rewardRate = notifyReward(periodState, amount, periodState.emission, getPeriodDuration());
periodState.distributed += amount;
uint256 balance = rewardToken.balanceOf(address(this));
if (rewardRate * getPeriodDuration() > balance) {
revert InsufficientRewardBalance();
}
lastUpdateTime = block.timestamp;
emit RewardNotified(amount);
}
​

Impact

Gauges do not actually receive tokens despite being allocated rewards.

Tools Used

Manual

Recommendations

Ensure that tokens are actually transferred when rewards are distributed. Modify distributeRewards to include a token transfer.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.