Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

distributeRevenue() and distributeRewards() do not transfer rewards to a gauge.

sl1

Bug description

When distributeRewards() function of the GaugeController is called, it invokes notifyRewardAmount() function of the gauge.

GaugeController.sol#L323-L332

function distributeRewards(
address gauge
) external override nonReentrant whenNotPaused {
if (!isGauge(gauge)) revert GaugeNotFound();
if (!gauges[gauge].isActive) revert GaugeNotActive();
uint256 reward = _calculateReward(gauge);
if (reward == 0) return;
IGauge(gauge).notifyRewardAmount(reward);

However, the function does not transfer rewards to a gauge making notifyRewardAmount() revert due to the following check.

BaseGauge.sol#L360-L363

uint256 balance = rewardToken.balanceOf(address(this));
if (rewardRate * getPeriodDuration() > balance) {
revert InsufficientRewardBalance();
}

The same can be said about distributeRevenue() function of the GaugeController, which calls _distributeToGauges(). _distributeToGauges() also notifies the reward amount to a gauge, without transferring rewards.

GaugeController.sol#L559-L561

if (gaugeShare > 0) {
IGauge(gauge).notifyRewardAmount(gaugeShare);
}

Impact

Both distributeRewards() and distributeRevenue() functions will revert as notifyRewardAmount() require assets to be transferred in.

Recommended Mitigation

Transfer assets when calling notifyRewardAmount.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.