Submission Details
Severity:
Incorrect Period Initialization in GaugeController
Summary
addGauge initializes periods with block.timestamp, potentially causing time-weighted averages to include past timestamps. This may skew calculations.
Vulnerability Details
Current implementation of GaugeController's addGauge function
function addGauge(address gauge, GaugeType gaugeType, uint256 initialWeight) external onlyGaugeAdmin {
// Initialize period with current timestamp
TimeWeightedAverage.Period storage period = gaugePeriods[gauge];
TimeWeightedAverage.createPeriod(
period,
block.timestamp, // Issue: Using current timestamp
duration,
periodWeight,
periodWeight
);
}
Impact of using block.timestamp
Time-weighted calculations include past periods
Impact
Initial period weights become misaligned
Reward distributions start from incorrect timestamps
Period boundaries don't align with intended cycles
Tools Used
Manual review
Recommendations
Align period start times with future epochs (here's like, block.timestamp + periodDuration) to ensure proper windowing.
function addGauge(address gauge, GaugeType gaugeType, uint256 initialWeight) external onlyGaugeAdmin {
uint256 duration = gaugeType == GaugeType.RWA ? 30 days : 7 days;
// Calculate next clean epoch boundary
uint256 currentEpoch = block.timestamp / duration;
uint256 nextEpochStart = (currentEpoch + 1) * duration;
TimeWeightedAverage.Period storage period = gaugePeriods[gauge];
TimeWeightedAverage.createPeriod(
period,
nextEpochStart,
duration,
periodWeight,
periodWeight
);
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.