Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

GaugeController Fails to Transfer Rewards Before Notification

oxelmiguel

Summary

The GaugeController contract is responsible for distributing rewards to gauges. However, a critical bug prevents rewards from being properly distributed. Specifically, the GaugeController does not transfer reward tokens to the gauge before calling notifyRewardAmount(). As a result, the reward distribution fails and reverts due to an insufficient balance check.

Vulnerability Details

Issue

The distributeRewards() function in GaugeController calls IGauge(gauge).notifyRewardAmount(reward) but does not transfer the reward tokens beforehand. This leads to a revert in notifyRewardAmount() due to the following check:

if (rewardRate * getPeriodDuration() > balance) {
revert InsufficientRewardBalance();
}

Since the reward tokens were never transferred, the balance remains zero, causing the function to revert.

Code Snippet

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/gauges/GaugeController.sol#L323

function distributeRewards(address gauge) external override nonReentrant whenNotPaused {
if (!isGauge(gauge)) revert GaugeNotFound();
if (!gauges[gauge].isActive) revert GaugeNotActive();
uint256 reward = _calculateReward(gauge);
if (reward == 0) return;
IGauge(gauge).notifyRewardAmount(reward);
emit RewardDistributed(gauge, msg.sender, reward);
}

Impact

  • No rewards are distributed to gauges, making the staking mechanism ineffective.

Tools Used

  • Manual code review

Recommendations

** Transfer Rewards Before Notifying the Gauge**

Modify distributeRewards() to send the reward to the gauge before calling notifyRewardAmount()

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!