Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

user weight and boost is wrong calculating

sagsick

Summary

the function which get the user base weight is giving the wrong base weight and boost.

Vulnerability Details

in the function 'getUserWeight' in the BaseGuage.sol Contract it calculate the base weight of the user. which is public function. the function

function getUserWeight(address account) public view virtual returns (uint256) {
uint256 baseWeight = _getBaseWeight(account);
return _applyBoost(account, baseWeight);
}

in this function it call the '_getBaseWeight(account)' with the paramter which is passed by the user. then the function which is called

function _getBaseWeight(address account) internal view virtual returns (uint256) {
//here the instead of address(this) it should be account
return IGaugeController(controller).getGaugeWeight(address(this));
}

the parameter which is passed it should get passed to the getGaugeWeight not he address(this). address(this) refers to the contract instance not the account which i passed. that function get return the address and pass to the '_applyBoost'

where this function apply the boost which is calculated wrongly. this function should get user's current weight including boost

Impact

it can change the weight of the user and apply his boost wrongly which

Tools Used

manually

Recommendations

try to use the account which is passed in function argument not the address(this)

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge._getBaseWeight ignores account parameter and returns gauge's total weight, allowing users to claim rewards from gauges they never voted for or staked in

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge._getBaseWeight ignores account parameter and returns gauge's total weight, allowing users to claim rewards from gauges they never voted for or staked in

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.