Submission Details
Severity:
`boostState.minBoost`has been wrongly initialized as `1e18`in the `BaseGauge` instead of `10000`
Details
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/governance/gauges/BaseGauge.sol#L142
BaseGauge wronly initialized the minBoost as 1e18which implies a min Boost of 1000000000000x boost instead of 1x. As can be seen from the docs, this value is supposed to be 1x that is 10000. There is provision in BaseGauge::setBoostParameters for this to be changed. However, in the period where it is not changed, there is room for the the protocol accounting to be manipulated.
Impact
Wrong accounting
Tool Used
Manual Review
Recommendation
- boostState.minBoost = 1e18;
+ boostState.minBoost = 10000;
Updates
Lead Judging Commences
inallhonesty about 1 month ago
Submission Judgement Published Assigned finding tags:
boostState.minBoost is set to 1e18
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.