Core Contracts

Summary

The GaugeController contract contains a medium-severity issue in its revenue distribution logic. The contract calculates a 20% performance fee share, but this amount is never actually distributed to any party, nor is the associated performanceFees mapping updated. As a result, the performance fee remains unallocated, leading to unintended revenue misallocation within the system.

Vulnerability Details

Within the distributeRevenue function, the contract computes the fee shares as follows:

After calculating these shares:

• Only veRAACShare is utilized, as it is added to the revenueShares mapping and then distributed to gauges.

• The performanceShare is computed but never distributed, and the performanceFees mapping remains unused.

This oversight results in 20% of the revenue that should be allocated as performance fees being effectively ignored.

Impact

• Revenue Misallocation: The protocol fails to allocate 20% of the revenue, which may lead to financial discrepancies over time.

• Incentive Misalignment: Stakeholders expecting performance fee distributions may experience misaligned incentives.

• Operational Oversight: Although this issue does not pose an immediate security threat, it could undermine trust in the protocol’s financial processes if left unaddressed.

Tools Used

Manual audit

Recommendations

• Implement Performance Fee Distribution: Update the distributeRevenue function to properly allocate the performanceShare to its intended recipients. This may involve updating the performanceFees mapping and implementing the corresponding distribution mechanism.

• Review Fee Handling Logic: Conduct a comprehensive audit of all fee-related logic to ensure that each fee component is correctly calculated, recorded, and distributed.