Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

distributeRevenue() and distributeRewards() do not transfer rewards to a gauge.

sl1

Bug description

When distributeRewards() function of the GaugeController is called, it invokes notifyRewardAmount() function of the gauge.

GaugeController.sol#L323-L332

function distributeRewards(
address gauge
) external override nonReentrant whenNotPaused {
if (!isGauge(gauge)) revert GaugeNotFound();
if (!gauges[gauge].isActive) revert GaugeNotActive();
uint256 reward = _calculateReward(gauge);
if (reward == 0) return;
IGauge(gauge).notifyRewardAmount(reward);

However, the function does not transfer rewards to a gauge making notifyRewardAmount() revert due to the following check.

BaseGauge.sol#L360-L363

uint256 balance = rewardToken.balanceOf(address(this));
if (rewardRate * getPeriodDuration() > balance) {
revert InsufficientRewardBalance();
}

The same can be said about distributeRevenue() function of the GaugeController, which calls _distributeToGauges(). _distributeToGauges() also notifies the reward amount to a gauge, without transferring rewards.

GaugeController.sol#L559-L561

if (gaugeShare > 0) {
IGauge(gauge).notifyRewardAmount(gaugeShare);
}

Impact

Both distributeRewards() and distributeRevenue() functions will revert as notifyRewardAmount() require assets to be transferred in.

Recommended Mitigation

Transfer assets when calling notifyRewardAmount.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!