Core Contracts

Summary

BaseGauge's reward distribution ignores user participation and amounts, instead distributing rewards based only on time elapsed since last checkpoint.

Vulnerability Details

The reward calculation uses global time tracking and gauge weight instead of user participation.

Initial state with example values:

User A first interaction with any function that has the updateReward modifier (24h):

User A calls getReward (which has the updateReward modifier) after 1h (25h):

User B calls getReward (which has the updateReward modifier) as their first interaction 1h later (26h):

User B calls getReward after a day (50h):

User A calls getReward after 1h (51h):

Issues:

• rewardPerTokenStored is the same for everyone

• First-time users getting all historical rewards

• Subsequent claims get all rewards since last checkpoint regardless of participation

• No tracking of actual participation periods

• Staking/withdrawing tokens has no effect

Impact

Critical: Rewards are not distributed based on participation, leading to unfair distribution where only first users can claim rewards.

Recommendations

The reward distribution mechanism should be redesigned to reward users based on participation.