Submission Details
Severity:
calculateRWAEmission() and calculateRAACEmission() in GaugeController are not marked virtual so distributeRewards() can not be correctly customized by inheriting contracts
Description
distributeRewards() internally calls _calculateReward() which then calls _calculateRWAEmission() and _calculateRAACEmission(). These functions say:
File: contracts/core/governance/gauges/GaugeController.sol
379: function _calculateRWAEmission() internal view returns (uint256) {
380: // Monthly RWA emission calculation
381:@---> // This should be implemented based on your tokenomics
382: return 1000000 * 10**18; // Example value
383: }
384:
385: /**
386: * @notice Calculates RAAC emission rate
387: * @dev Weekly emission rate for RAAC gauges
388: * @return Weekly emission amount
389: */
390: function _calculateRAACEmission() internal view returns (uint256) {
391: // Weekly RAAC emission calculation
392:@---> // This should be implemented based on your tokenomics
393: return 250000 * 10**18; // Example value
394: }
These functions are however not marked as virtual and hence child contracts won't be able to override and change these implementations, defeating the purpose of using GaugeController.sol for reward distribution.
Mitigation
Mark the functions as virtual.
Updates
Lead Judging Commences
inallhonesty about 1 month ago
Submission Judgement Published Assigned finding tags:
GaugeController uses hardcoded placeholder emission values in _calculateRWAEmission() and _calculateRAACEmission() instead of actual tokenomics-based rates
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.