Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Weekly emission period can't be updated in the `RAACGauge` due the missing implementation in the `GaugeController`

kiteweb3

Summary

The RAACGauge::setWeeklyEmission can only be called by the controller address (GaugeController). This function is meant to allow adjusting the weekly emission rate for RAAC tokens. However, while the GaugeController has the necessary CONTROLLER_ROLE permissions, it lacks any implementation to actually call this function.

Vulnerability Details

The RAACGauge::setWeeklyEmission function:

@> function setWeeklyEmission(uint256 _weeklyEmission) external onlyController {
periodState.emission = _weeklyEmission;
emit EmissionUpdated(_weeklyEmission);
}

has the onlyController modifier which comes from BaseGauge. Looking at BaseGauge, this modifier is defined as:

modifier onlyController() {
@> if (!hasRole(CONTROLLER_ROLE, msg.sender)) revert UnauthorizedCaller();
_;
}

In BaseGauge's constructor, the controller address is granted the CONTROLLER_ROLE:

@> _grantRole(CONTROLLER_ROLE, _controller);

Looking at the GaugeController contract, there isn't any direct function to call setWeeklyEmission. Additionally, this function is not included in the IGauge interface that GaugeController uses to interact with gauges.

Impact

No mechanism exists to adjust weekly emission rates through the controller, despite the contract being designed with this intention. The setWeeklyEmission function becomes effectively unusable because the authorized controller has no way to call it.

Tools Used

Manual review

Recommendations

Add setWeeklyEmission to the IGauge interface and implement the corresponding function in GaugeController.

IGauge.sol

+ function setWeeklyEmission(uint256 emission) external;

GaugeController.sol

+ function updateWeeklyEmission(address gauge, uint256 emission) external onlyGaugeAdmin {
+ if (!isGauge(gauge)) revert GaugeNotFound();
+ IGauge(gauge).setWeeklyEmission(emission);
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!