Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`emission` period can't be updated in the due the missing implementation in the `GaugeController`

kiteweb3

Summary

The BaseGauge::setEmission can only be called by the controller address (GaugeController). This function is meant to set emission cap for the period. However, while the GaugeController has the necessary CONTROLLER_ROLE permissions, it lacks any implementation to actually call this function.

Vulnerability Details

The BaseGauge::setEmission function

function setEmission(uint256 emission) external onlyController {
if (emission > periodState.emission) revert RewardCapExceeded();
periodState.emission = emission;
emit EmissionUpdated(emission);
}

has the onlyController modifier defined as:

modifier onlyController() {
@> if (!hasRole(CONTROLLER_ROLE, msg.sender)) revert UnauthorizedCaller();
_;
}

In BaseGauge's constructor, the controller address is granted the CONTROLLER_ROLE:

@> _grantRole(CONTROLLER_ROLE, _controller);

Looking at the GaugeController contract, there isn't any direct function to call setEmission. Additionally, this function is not included in the IGauge interface that GaugeController uses to interact with gauges.

Impact

No mechanism exists to adjust the emission cap for the period, despite the contract being designed with this intention. The setEmission function becomes effectively unusable because the authorized controller has no way to call it.

Tools Used

Manual review

Recommendations

Add setEmission to the IGauge interface and implement the corresponding function in GaugeController.

IGauge.sol

+ function setEmission(uint256 emission) external;

GaugeController.sol

+ function updateGaugeEmission(address gauge, uint256 emission) external onlyGaugeAdmin {
+ if (!isGauge(gauge)) revert GaugeNotFound();
+ IGauge(gauge).setEmission(emission);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.