Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing `BaseGauge::MAX_REWARD_RATE` validation in reward distribution

kiteweb3

Summary

The BaseGauge::MAX_REWARD_RATE is defined in the contract to Maximum reward rate to prevent overflow (as described in the natspec) but the contract fails to implement validation against this limit in reward distribution functions. The allow setting reward rates higher than the intended maximum creating a risk of economic imbalance and potential overflow in reward calculations.

Vulnerability Details

function notifyReward(
PeriodState storage state,
uint256 amount,
uint256 maxEmission,
uint256 periodDuration
) internal view returns (uint256) {
if (amount > maxEmission) revert RewardCapExceeded();
if (amount + state.distributed > state.emission) {
revert RewardCapExceeded();
}
​
uint256 rewardRate = amount / periodDuration;
if (rewardRate == 0) revert ZeroRewardRate();
​
@audit: missing check
​
return rewardRate;
​
}
​

Impact

The BaseGauge::MAX_REWARD_RATE missing checks allow setting reward rates higher than the intended maximum. This can lead to potential overflow in reward calculations and economic imbalance in reward distribution risking to drain the contract funds faster than intended.

Tools Used

Manual review

Recommendations

Add explicit validation against MAX_REWARD_RATE in the BaseGauge::notifyReward.

function notifyReward(
PeriodState storage state,
uint256 amount,
uint256 maxEmission,
uint256 periodDuration
) internal view returns (uint256) {
if (amount > maxEmission) revert RewardCapExceeded();
if (amount + state.distributed > state.emission) {
revert RewardCapExceeded();
}
​
uint256 rewardRate = amount / periodDuration;
if (rewardRate == 0) revert ZeroRewardRate();
+ if (rewardRate > MAX_REWARD_RATE) revert RewardRateTooHigh();
​
return rewardRate;
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge lacks enforcement of both distributionCap and MAX_REWARD_RATE limits

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge lacks enforcement of both distributionCap and MAX_REWARD_RATE limits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!