Core Contracts

Summary

In the GaugeController contract the addGauge function initializes the typeWeight field of a gauge to 0 instead of using the configured typeWeights[gaugeType] value. While this does not currently impact reward calculations (as typeWeight appears unused), it introduces inconsistency and risks future errors if the field becomes part of the logic.

Vulnerability Details

Affected Code:

Explanation:
When creating a new gauge, the typeWeight property is hardcoded to 0, even though the contract maintains type-specific weights in typeWeights[GaugeType]. While the current reward calculation logic in _calculateReward uses typeWeights[gaugeType] directly (bypassing the gauge’s typeWeight), this mismatch creates a discrepancy in the stored data. If future updates accidentally reference typeWeight instead of typeWeights, reward calculations would be corrupted due to the incorrect initialization.

Impact

Severity: Low

Rationale:
There is no immediate exploit, as the typeWeight field is not used in the current logic. However, this creates:

Data inconsistency: Stored typeWeight does not reflect the actual type weight.

Future risk: Developers might mistakenly rely on typeWeight in later updates, leading to incorrect reward distributions (e.g., gauges using 0 instead of their intended type weight).

Tools Used

• Manual code review

Recommendations

Correct Initialization:
Initialize typeWeight using the configured typeWeights[gaugeType] value:

Deprecate Unused Field (Optional):
If typeWeight is redundant, remove it from the Gauge struct to eliminate confusion.

Documentation:
Add comments clarifying whether typeWeight is intentional and how it should be used.