Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

earned() uses incorrect weight when calculating rewards.

sl1

Bug description

When updating reward state for an account, _updateReward() function of the gauge is invoked.

BaseGauge.sol#L171-L177

if (account != address(0)) {
UserState storage state = userStates[account];
state.rewards = earned(account);
state.rewardPerTokenPaid = rewardPerTokenStored;
state.lastUpdateTime = block.timestamp;
emit RewardUpdated(account, state.rewards);
}

earned() function is responsible for calculating user's rewards.

BaseGauge.sol#L583-L587

return
((getUserWeight(account) *
(getRewardPerToken() -
userStates[account].rewardPerTokenPaid)) / 1e18) +
userStates[account].rewards;

However, getUserWeight() returns the weight of a gauge instead of user's weight.

BaseGauge.sol#L594-L597

function getUserWeight(
address account
) public view virtual returns (uint256) {
uint256 baseWeight = _getBaseWeight(account);
return _applyBoost(account, baseWeight);
}

BaseGauge.sol#L218-L220

function _getBaseWeight(
address account
) internal view virtual returns (uint256) {
return IGaugeController(controller).getGaugeWeight(address(this));
}

The code comments of the _getBaseWeight() function state that it must be implemented by the child contract, however both RAACGauge and RWAGauge do not overwrite it making the rewards accounting incorrect.

Impact

Because gauge's weight is used instead of user's weight, the rewards accounting is broken and user can claim more rewards than he should.

Recommended Mitigation

Implement _getBaseWeight() function in RAACGauge and RWAGauge so it returns user's weight.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::earned calculates rewards using getUserWeight instead of staked balances, potentially allowing users to claim rewards by gaining weight without proper reward checkpoint updates

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::earned calculates rewards using getUserWeight instead of staked balances, potentially allowing users to claim rewards by gaining weight without proper reward checkpoint updates

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.