Core Contracts

Summary

_totalSupply variable can be inflated, leading to less rewards for regular users. This is possible due to it's use in the computation of rewards in `BaseGauge`

Vulnerability Details

The _updateReward eventually calls the earned function, which looks like this:

As seen in this block of code, it calls the getRewardPerToken function, which looks as it follows:

As seen here, the totalSupply is used for division, which can be used by malicious user with the following attack:

1. User wants to get his rewards and calls getReward function

2. Malicious user sees his transaction in the mempool and frontruns him by getting a big flash loan, and then calling the stake function, inflating the totalSupply variable this way

This will lead to user receiving less rewards than he should

Impact

User will receive less than deserved rewards because of the malicious user

Tools Used

Manual Review

Recommendations

Apply a slippage protection to practically any function that calls the earned and getRewardPerToken functions. This will ensure that users are not deprived from the proper rewards they should receive