Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: high
Valid

Performance fee is lost

Summary

The GaugeController contract calculates but fails to track or notify the 20% performance fee portion of distributed revenue.

Vulnerability Details

The distributeRevenue function splits revenue but only accounts for the veRAACToken share:

function distributeRevenue(
GaugeType gaugeType,
uint256 amount
) external onlyRole(EMERGENCY_ADMIN) whenNotPaused {
if (amount == 0) revert InvalidAmount();
> uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
> uint256 performanceShare = amount * 20 / 100; // 20% performance fee
revenueShares[gaugeType] += veRAACShare;
> _distributeToGauges(gaugeType, veRAACShare);
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);
}

While GaugeController only handles calculations and notifications (not actual token transfers), the performanceShare portion is completely unaccounted for, unlike veRAACShare which is notified to gauges.

Impact

20% of revenue has no accounting mechanism, making it impossible to track or distribute performance fees correctly.

Recommendations

Account for performance fees.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.