Core Contracts

Summary

The reward calculation in the BaseGauge is based on the total supply of the gauge and user weight, but not on the staked token amount. This design incentivizes users to unstake tokens, reducing the totalSupply() and thus increasing the reward yield rate (getRewardPerToken()), enabling them to maximize rewards without staking tokens.

Vulnerability Details

In BaseGauge::earned(), the formula for calculating rewards uses getRewardPerToken(), which depends on the total supply of the gauge. A smaller totalSupply() results in a higher getRewardPerToken(), increasing the reward yield. This creates an incentive for users to unstake their tokens, thereby reducing the total supply and benefiting from a higher yield without having to stake tokens.

Impact

This vulnerability allows users to manipulate the system by unstaking tokens to maximize their reward yield.

Tools Used

vscode

Recommendations

The user’s staked token amount should be included in the reward calculation. This would prevent users from manipulating the total supply by simply unstaking their tokens.