Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Initial weight for the gauge can't be set in the due the missing implementation in the `GaugeController`

kiteweb3

Summary

The BaseGauge::setInitialWeight can only be called by the controller address (GaugeController). This function is meant to set initial weight for the gauge. However, while the GaugeController has the necessary CONTROLLER_ROLE permissions, it lacks any implementation to actually call this function.

Vulnerability Details

The `BaseGauge::setInitialWeight function

@> function setInitialWeight(uint256 weight) external onlyController {
uint256 periodDuration = getPeriodDuration();
uint256 currentTime = block.timestamp;
uint256 nextPeriodStart = ((currentTime / periodDuration) + 2) * periodDuration;
TimeWeightedAverage.createPeriod(
periodState.votingPeriod,
nextPeriodStart,
periodDuration,
weight,
10000 // WEIGHT_PRECISION
);
​
periodState.periodStartTime = nextPeriodStart;
}

has the onlyController modifier defined as:

modifier onlyController() {
@> if (!hasRole(CONTROLLER_ROLE, msg.sender)) revert UnauthorizedCaller();
_;
}

In BaseGauge's constructor, the controller address is granted the CONTROLLER_ROLE:

@> _grantRole(CONTROLLER_ROLE, _controller);

Looking at the GaugeController contract, there isn't any direct function to call setInitialWeight. Additionally, this function is not included in the IGauge interface that GaugeController uses to interact with gauges.

Impact

No mechanism exists to set initial weight for the gauge, despite the contract being designed with this intention. The setInitialWeight function becomes effectively unusable because the authorized controller has no way to call it.

Tools Used

Manual review

Recommendations

Add setInitialWeight to the IGauge interface and implement the corresponding function in GaugeController.

IGauge.sol

+ function setInitialWeight(uint256 weight) external;

BaseGauge.sol

+ function initializeGaugeWeight(address gauge, uint256 weight) external onlyGaugeAdmin {
+ if (!isGauge(gauge)) revert GaugeNotFound();
+ IGauge(gauge).setInitialWeight(weight);
+ }
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!