Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong period finish in BaseGauge

ChainDefenders

Summary

In BaseGauge, timestamps are not handled correctly during reward calculation, causing the reward period to extend indefinitely.

Vulnerability Details

Scenario:

  1. lastUpdateTime is initialized as 0, and the period length is 10.

  2. At block.timestamp = 2, a user calls getReward. The _updateReward function computes getRewardPerToken based on rate * (2 - 0), then updates lastUpdateTime to 2. Consequently, periodFinish is now 2 + 10 = 12, instead of the expected 10.

  3. At block.timestamp = 4, getRewardPerToken is recalculated as rate * (4 - 2). Due to the incorrect computation of periodFinish, it extends indefinitely. Now, periodFinish becomes 4 + 10 = 14, instead of remaining at 10.

function periodFinish() public view returns (uint256) {
return lastUpdateTime + getPeriodDuration();
}
​
/**
* @notice Calculates current reward per token
* @return Current reward per token value
*/
function getRewardPerToken() public view returns (uint256) {
if (totalSupply() == 0) {
return rewardPerTokenStored;
}
​
return rewardPerTokenStored + (
(lastTimeRewardApplicable() - lastUpdateTime) * rewardRate * 1e18 / totalSupply()
);
}
​
/**
* @notice Calculates earned rewards for an account
* @param account Address to calculate earnings for
* @return Amount of rewards earned
*/
function earned(address account) public view returns (uint256) {
return (getUserWeight(account) *
(getRewardPerToken() - userStates[account].rewardPerTokenPaid) / 1e18
) + userStates[account].rewards;
}

Impact

The incorrect computation of periodFinish results in an unintended extension of the reward period. This leads to incorrect reward distribution, potential reward manipulation, and unfair advantages for some users.

Tools Used

Manual review

Recommendations

Modify periodFinish to be determined based on a fixed start time plus a defined period duration, rather than relying on lastUpdateTime.

Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge period end time miscalculation creates circular dependency between periodFinish() and lastUpdateTime, preventing periods from naturally ending and disrupting reward distribution

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge period end time miscalculation creates circular dependency between periodFinish() and lastUpdateTime, preventing periods from naturally ending and disrupting reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.