Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

distributeRewards() can be called unlimited amount of time disregarding the emission schedule.

sl1

Bug description

When GaugeController::distributeRewards() is called, it calculates rewards based on the RWA or RAAC emission.

GaugeController.sol#L369-L371

uint256 periodEmission = g.gaugeType == GaugeType.RWA
? _calculateRWAEmission()
: _calculateRAACEmission();
return
(periodEmission * gaugeShare * typeShare) /
(WEIGHT_PRECISION * WEIGHT_PRECISION);

As can be seen from the _calculateRWAEmission and _calculateRAACEmission functions, they return monthly or weekly emissions respectively. Therefore distributeRewards() should respect that and be called once a week for RAAC and once a month for RWA. But currently it's disregarded, and monthly and weekly emissions can be distributed every second.

GaugeController.sol#L375-L378

/**
* @notice Calculates RWA emission rate
* @dev Monthly emission rate for RWA gauges <--------- @
* @return Monthly emission amount
*/

GaugeController.sol#L385-L389

/**
* @notice Calculates RAAC emission rate
* @dev Weekly emission rate for RAAC gauges <--------- @
* @return Weekly emission amount
*/

Impact

Disruption of the emission schedule.

Recommended Mitigation

Ensure that for RWA distributeRewards() can be called only once a month and for RAAC it should only be callable once a week.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController's distributeRewards lacks time-tracking, allowing attackers to repeatedly distribute full period rewards until hitting emission caps

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController's distributeRewards lacks time-tracking, allowing attackers to repeatedly distribute full period rewards until hitting emission caps

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.