Core Contracts

Summary:

In https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/interfaces/core/governance/gauges/IGauge.sol#L42

function notifyRewardAmount(uint256 amount) external;

No explicit cap is mentioned in the interface, meaning a large reward allocation could break the contract. Also no nonReentrant modifier were used.

Vulnerability Details:

The doesn't explicit cap mentioned in the interface so if somebody use large numbers of rewards allocation it will break the contract and I will be reward cap enforcement

Impact;

Reward cap enforcement that can break the contract.

Tools Used: none

Recommendations

Enforce max reward caps to prevent excessive distributions (RewardCapExceeded).

Ensure rewardAmount doesn’t exceed contract balance (InsufficientRewardBalance).