Submission Details
Severity:
`BaseGauge::constructor` is setting wrong value for `boostState.minBoost`
Summary
BaseGauge::constructor#L142 is setting wrong value for boostState.minBoost.
Let's say minBoost is 1x, so it will be 10000
Vulnerability Details
constructor(
address _rewardToken,
address _stakingToken,
address _controller,
uint256 _maxEmission,
uint256 _periodDuration
) {
rewardToken = IERC20(_rewardToken);
stakingToken = IERC20(_stakingToken);
controller = _controller;
// ...OTHER_CODES...
// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
142:: boostState.minBoost = 1e18; 👈👈
boostState.boostWindow = 7 days;
// ...OTHER_CODES...
}
On BoostController#L42, we can see it is setting MIN_BOOST = 10000 (1x) which is the correct one.
contract BoostController is IBoostController, ReentrancyGuard, AccessControl, Pausable {
using BoostCalculator for BoostCalculator.BoostState;
// State variables
BoostCalculator.BoostState private boostState;
// ...OTHER_CODES...
/// @notice Maximum boost multiplier (2.5x) in basis points
uint256 public constant MAX_BOOST = 25000;
/// @notice Minimum boost multiplier (1x) in basis points 👈
42:: uint256 public constant MIN_BOOST = 10000; 👈👈
/// @notice Minimum duration for boost delegation
uint256 public constant MIN_DELEGATION_DURATION = 7 days;
// ...OTHER_CODES...
}
Impact
The boostState.minBoost should be 1x which is actually 10000.
Because boostState.minBoost is used on lots of different functions, so the protocol will not work as expected.
1e18 is actually a large value like 1 * 10 ** 18
Tools Used
Manual review
Recommendations
constructor(
address _rewardToken,
address _stakingToken,
address _controller,
uint256 _maxEmission,
uint256 _periodDuration
) {
rewardToken = IERC20(_rewardToken);
stakingToken = IERC20(_stakingToken);
controller = _controller;
// ...OTHER_CODES...
// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
- boostState.minBoost = 1e18;
+ boostState.minBoost = 10000; // actual 1x
boostState.boostWindow = 7 days;
// ...OTHER_CODES...
}
Updates
Lead Judging Commences
inallhonesty about 2 months ago
Submission Judgement Published Assigned finding tags:
boostState.minBoost is set to 1e18
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.