Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect decimals for `minBoost`

falendar

Summary

The BaseGauge contract initializes minBoost with incorrect decimal scaling (1e18) while maxBoost uses basis points (25,000), causing boost calculation to fail due to underflow.

Vulnerability Details

Boost parameters are initialized with inconsistent scaling in BaseGauge:

boostState.maxBoost = 25000;
boostState.minBoost = 1e18;

_applyBoost calls BoostCalculator.calculateBoost, using the boost parameters:

functuon calculateBoost(..., BoostParameters memory params) {
uint256 boostRange = params.maxBoost - params.minBoost;
}

The boost calculation expects both values in basis points where:

  • maxBoost: 25,000 = 2.5x

  • minBoost: 10,000 = 1x (should be this)

Instead, minBoost is set to 1e18, causing arithmetic underflow when calculating boost range.

Impact

High: Boost calculations will revert due to underflow, breaking core reward distribution functionality.

Recommendations

Initialize boost parameters using consistent basis points scaling:

boostState.maxBoost = 25000;
- boostState.minBoost = 1e18;
+ boostState.minBoost = 10000;
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

boostState.minBoost is set to 1e18

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.