Core Contracts

Summary

The current implementation in BaseGauge::notifyRewardAmount() does not accurately enforce the maximum allowable reward distribution, potentially leading to over-distribution of rewards and undermining the economic model of the gauge.

notifyRewardAmount

Vulnerability Details

Code Snippet

The problematic line of code is as follows:

1. Current Logic: The condition checks if the amount of rewards being notified exceeds the periodState.emission. If this condition is true, the transaction is reverted with the RewardCapExceeded error.

2. Logical Flaw: The check only considers the amount being added, without accounting for the rewards that have already been distributed during the current period. The total rewards that can be distributed should be the sum of the amount being notified and the already distributed rewards (state.distributed).

3. Potential Consequences:

   • If the amount being notified is less than or equal to periodState.emission, but the total of amount + state.distributed exceeds periodState.emission, the contract will allow an invalid state where the total rewards exceed the emission cap.

   • This could lead to unintended behavior, such as over-distribution of rewards, which may violate the intended economic model of the gauge and potentially harm the interests of stakeholders.

Recommendations

To resolve this issue, the condition should be updated to check the total rewards being notified against the emission cap. The corrected line should be: