Summary
BaseGauge::_applyBoost has wrong value
on returning calculation
Vulnerability Details
BaseGauge::_applyBoost
* @notice Applies boost multiplier to base weight
* @dev Calculates boost based on veToken balance and parameters
* @param account Address to calculate boost for
* @param baseWeight Base weight to apply boost to
* @return Boosted weight value
*/
function _applyBoost(address account, uint256 baseWeight) internal view virtual returns (uint256) {
if (baseWeight == 0) return 0;
IERC20 veToken = IERC20(IGaugeController(controller).veRAACToken());
uint256 veBalance = veToken.balanceOf(account);
uint256 totalVeSupply = veToken.totalSupply();
uint256 boost = BoostCalculator.calculateBoost(
veBalance,
totalVeSupply,
params
);
return (baseWeight * boost) / 1e18; 👈👈
}
On the doc, we can see that the Precision for weight calculations value is 10000
Impact
The BIPS is 10000.
10000
and 1e18
is not the same because 1e18
is actually 1 * 10 ** 18
The calculation result will be totally wrong.
Tools Used
Manual review
Recommendations
Instead of 1e18
use 10000
function _applyBoost(address account, uint256 baseWeight) internal view virtual returns (uint256) {
if (baseWeight == 0) return 0;
IERC20 veToken = IERC20(IGaugeController(controller).veRAACToken());
uint256 veBalance = veToken.balanceOf(account);
uint256 totalVeSupply = veToken.totalSupply();
//...OTHER_CODES...
uint256 boost = BoostCalculator.calculateBoost(
veBalance,
totalVeSupply,
params
);
- return (baseWeight * boost) / 1e18;
+ return (baseWeight * boost) / 10000;
}