Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Monthly emission period can't be updated in the `RWAGauge` due the missing implementation in the `GaugeController`

kiteweb3

Summary

The RWAGauge::setMonthlyEmission can only be called by the controller address (GaugeController). This function is meant to allow adjusting the monthly emission rate for RAAC tokens. However, while the GaugeController has the necessary CONTROLLER_ROLE permissions, it lacks any implementation to actually call this function.

Vulnerability Details

The RWAGauge::setMonthlyEmission function:

@> function setMonthlyEmission(uint256 _monthlyEmission) external onlyController {
periodState.emission = _monthlyEmission;
emit EmissionUpdated(_monthlyEmission);
}

has the onlyController modifier which comes from BaseGauge. Looking at BaseGauge, this modifier is defined as:

modifier onlyController() {
@> if (!hasRole(CONTROLLER_ROLE, msg.sender)) revert UnauthorizedCaller();
_;
}

In BaseGauge's constructor, the controller address is granted the CONTROLLER_ROLE:

@> _grantRole(CONTROLLER_ROLE, _controller);

Looking at the GaugeController contract, there isn't any direct function to call setMonthlyEmission. Additionally, this function is not included in the IGauge interface that GaugeController uses to interact with gauges.

Impact

No mechanism exists to adjust weekly emission rates through the controller, despite the contract being designed with this intention. The setMonthlyEmission function becomes effectively unusable because the authorized controller has no way to call it.

Tools Used

Manual review

Recommendations

Add setMonthlyEmission to the IGauge interface and implement the corresponding function in GaugeController.

IGauge.sol

+ function setMonthlyEmission(uint256 monthlyEmission) external;

GaugeController.sol

+ function updateMonthlyEmission(address gauge, uint256 emission) external onlyGaugeAdmin {
+ if (!isGauge(gauge)) revert GaugeNotFound();
+ IGauge(gauge).setMonthlyEmission(emission);
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!