Core Contracts

Summary

The notifyRewardAmount function in the BaseGauge contract overwrites the rewardRate when called multiple times within the same period. This results in a loss of previously allocated rewards, leading to incorrect reward distribution.

Vulnerability Details

Issue: Reward Rate Overwrite

The function notifyRewardAmount calculates rewardRate by dividing the notified amount by the period duration. However, each call to notifyRewardAmount replaces the previous rewardRate instead of accumulating it. Consequently, when notifyRewardAmount is called multiple times within the same period, the last call effectively erases any previous rewards that were set.

Code Reference:

This line of code updates rewardRate with the newly calculated value without considering any prior reward rates.

Example Scenario:

1. Call notifyRewardAmount(500 ether) at the beginning of the period.

2. Call notifyRewardAmount(500 ether) after three days.

3. The second call overwrites rewardRate, leading to only 500 ether being distributed instead of the expected 1000 ether.

If the contract instead accumulates the reward rate instead of overwriting it, the full 1000 ether reward would be distributed correctly.

Poc

run in BaseGauge.test.js

• poc

Explanation of output

The first test will log that user clain 9999 reward while the second test will log that the user claim 4999

In the second test user get the half of the first test because rewardRate are overwrite

Impact

• Users receive fewer rewards than expected when notifyRewardAmount is called multiple times within the same period.

• Inconsistent behavior where users receive the full reward if notified once, but only partial rewards if notified multiple times.

• Potential financial loss for users due to incorrect reward distribution.

Tools Used

• Manual code review

• Hardhat testing framework

• Ethers.js for interaction and simulation

Recommendations

Solution: Accumulate rewardRate

Instead of overwriting rewardRate, it should be incremented to account for multiple reward notifications within the same period.

Proposed Fix:

Modify the notifyRewardAmount function to accumulate the reward rate:

This ensures that rewards are correctly distributed based on the sum of all notifyRewardAmount calls within the same period, preventing reward loss and ensuring fair distribution.