Core Contracts

Summary

The notifyRewardAmount() function in the BaseGauge contract is responsible for notifying the system of new reward amounts to be distributed. However, it currently lacks a mechanism to enforce a cap on the total rewards that can be distributed.

Vulnerability Details

The protocol implements distributionCap which is a cap on reward distribution amount.

Now, in notifyRewardAmount(), the function does not check that the sum of new rewards being notified and those already distributed are within this cap.

As seen, the function is missing check for distribution cap. Without enforcing the distributionCap, the contract can distribute rewards indefinitely.

Impact

The protocol loses the ability to manage and control the total rewards distributed, which could affect the sustainability of the reward system.

Tools Used

Manual Review

Recommendations

The periodState.distributed is typically reset at the beginning of each new period. This means that while periodState.emission indicates how much can be distributed in the current period, it does not provide a cumulative total of rewards distributed over the lifetime of the contract.

• Introduce a new state variable, such as totalDistributed, to keep track of the cumulative total of rewards distributed across all periods.