Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Boost parameter can't be updated due the missing implementation in the `GaugeController`

kiteweb3

Summary

The BaseGauge::setBoostParameters can only be called by the controller address (GaugeController). This function is meant to update boost calculation parameters. However, while the GaugeController has the necessary CONTROLLER_ROLE permissions, it lacks any implementation to actually call this function.

Vulnerability Details

The BaseGauge::setBoostParameters function

@> function setBoostParameters(
uint256 _maxBoost,
uint256 _minBoost,
uint256 _boostWindow
) external onlyController {
boostState.maxBoost = _maxBoost;
boostState.minBoost = _minBoost;
boostState.boostWindow = _boostWindow;
}

has the onlyController modifier defined as:

modifier onlyController() {
@> if (!hasRole(CONTROLLER_ROLE, msg.sender)) revert UnauthorizedCaller();
_;
}

In BaseGauge's constructor, the controller address is granted the CONTROLLER_ROLE:

@> _grantRole(CONTROLLER_ROLE, _controller);

Looking at the GaugeController contract, there isn't any direct function to call setBoostParameters. Additionally, this function is not included in the IGauge interface that GaugeController uses to interact with gauges.

Impact

No mechanism exists to update boost calculation parameters, despite the contract being designed with this intention. The setBoostParameters function becomes effectively unusable because the authorized controller has no way to call it.

Tools Used

Manual review

Recommendations

Add setBoostParameters to the IGauge interface and implement the corresponding function in GaugeController.

IGauge.sol

+ function setBoostParameters(uint256 _maxBoost, uint256 _minBoost, uint256 _boostWindow) external;

BaseGauge.sol

+ function setGaugeBoostParameters(address gauge, uint256 maxBoost, uint256 minBoost, uint256 boostWindow) external onlyGaugeAdmin {
+ if (!isGauge(gauge)) revert GaugeNotFound();
+ IGauge(gauge).setBoostParameters(maxBoost, minBoost, boostWindow);
+}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!