Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

In BaseGauge :: constructor doing initialization boostState.maxBoost was scaled in Basis points while boostState.minBoost was scaled in WadRayMath

uncontrolledking

[M-1] In BaseGauge :: constructor doing initialization boostState.maxBoost was scaled in Basis points while boostState.minBoost was scaled in WadRayMath

Description: Doing initialization process in BaseGauge :: constructor the protocol initialize boostState.maxBoost = 25000; which is 2.5x in basis points and mistakenly initialize boostState.minBoost = 1e18; in wad which if turn to basis point is way more higher than 25000

Impact:
With this incorrect logic min boost becomes way more higher than max boost , this mistake will lead to calculation errors when used in functions, This definitely Breaks core boost mechanism assumptions

Proof of Concept:

constructor(
// @zeroaddresscheck
address _rewardToken,
address _stakingToken,
address _controller,
uint256 _maxEmission,
uint256 _periodDuration
) {
rewardToken = IERC20(_rewardToken);
stakingToken = IERC20(_stakingToken);
controller = _controller;
// Initialize roles
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(CONTROLLER_ROLE, _controller);
// Initialize boost parameters
// @audit minboost is more than maxboost
boostState.maxBoost = 25000; // 2.5x
@> boostState.minBoost = 1e18;
boostState.boostWindow = 7 days;
uint256 currentTime = block.timestamp;
uint256 nextPeriod = ((currentTime / _periodDuration) * _periodDuration) + _periodDuration;
// Initialize period state
periodState.periodStartTime = nextPeriod;
periodState.emission = _maxEmission;
TimeWeightedAverage.createPeriod(
periodState.votingPeriod,
nextPeriod,
_periodDuration,
0,
10000 // VOTE_PRECISION
);
}

This below is the vulnerable part in the function

// Initialize boost parameters
// @audit minboost is more than maxboost
boostState.maxBoost = 25000; // 2.5x
@> boostState.minBoost = 1e18;

Recommended Mitigation:
kindly use same scaling method

boostState.maxBoost = 25000; // 2.5x
- boostState.minBoost = 1e18;
+ boostState.minBoost = 10000; // 1.0x
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

boostState.minBoost is set to 1e18

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.