Core Contracts

Summary

The boostState.minBoost is set to an excessively high value (1e18), which leads to an underflow during boost calculations, causing the calculation to revert. As such, all reward-based functions are rendered unusable.

Vulnerability Details

In the constructor() of the BaseGauge contract, the following lines initialize the boost parameters:

Now, in _applyBoost() function which applies boost multiplier to base weight, the following exist:

The above called calculateBoost() function from the BoostCalculator library performs the following calculation:

This subtraction will yield a negative value, leading to an underflow error, which will cause the transaction to revert.

Issue Rationale:

The earned() function is used to update the state.rewards for a particular user during rewards update.

It invokes getUserWeight() to get the user's current weight including boost:

Since this function relies on the _applyBoost(), the whole rewards update will revert.

Impact

DoS in reward based functions:

The updateReward() modifier is responsible for updating rewards for a user before executing some functions. This is used in stake(), withdraw() and getReward().

As such, since this modifier propagates down to the _applyBoost() which has the underflow issue, these functions will always revert during execution preventing users from accessing them.

Tools Used

Manual Review

Recommendations

Update the initialization value for boostState.minBoost as follows: