Submission Details
Severity:
[L-1] Variable initialized incorrectly in `BaseGuage.sol` contract.
summary
In the BaseGuage.sol contract, the boostState.minBoost variable is supposed to be assigned as 10,000 in the constructor,but is wrongly initialized as 1e18.
Vulnerability Details
// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
@> boostState.minBoost = 1e18; //needed to be 1x ie, 10,000
Impact
This will cause a revert while calculating boost.
function calculateBoost(
uint256 veBalance,
uint256 totalVeSupply,
BoostParameters memory params
) internal pure returns (uint256) {
// Return base boost (1x = 10000 basis points) if no voting power
if (totalVeSupply == 0) {
return params.minBoost;
}
// Calculate voting power ratio with higher precision
uint256 votingPowerRatio = (veBalance * 1e18) / totalVeSupply;
// Calculate boost within min-max range
@> uint256 boostRange = params.maxBoost - params.minBoost; //--> This line will revert because params.minBoost is greater than params.maxBoost causing the boostRange to be negative which is not possible.
}
Tools Used
manual review
Recommendations
In the BaseGuage.sol constructor, add this
// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
- boostState.minBoost = 1e18;
+ boostState.minBoost = 10000; //1x
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
boostState.minBoost is set to 1e18
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.