Core Contracts

Summary

The BaseGauge contract's reward rate calculation suffers from precision loss due to integer division, resulting in users receiving slightly less rewards than intended over the reward period.

Vulnerability Detail

In the BaseGauge contract, the reward rate is calculated by dividing the reward amount by the period duration:

This integer division causes precision loss. When this rate is later used to distribute rewards over time, the total rewards distributed will be less than the original amount intended for distribution.

This has been demonstrated through testing:

In this example with 1000 tokens, there is a loss of 265,600 wei. While small in this case, the precision loss scales with larger amounts and could be more significant with tokens of different decimals.

Impact

Medium. The precision loss leads to a systematic underpayment of rewards to users, though the impact per user is relatively small. This does not result in lost funds but rather in slightly reduced rewards compared to what was intended.

Test demonstrating the issue:

Tool used

Manual Review

Recommendation

To mitigate this precision loss, implement fixed-point arithmetic by scaling up the reward rate calculation:

When distributing rewards, divide by the precision factor:
uint256 reward = (rewardRate * duration) / PRECISION;
This will ensure more accurate reward distribution and minimize precision losses.