Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Performance fees are not accounted in GaugeController#distributeRevenue()

notbozho

Summary

Inside the GaugeController contract, the distributeRevenue() function is intended to distribute the revenue generated by the system between veToken holders and gauges.

/**
* @notice Distributes revenue between veToken holders and gauges
* @dev Only callable by emergency admin
* @param gaugeType Type of gauge for distribution
* @param amount Amount to distribute
*/
function distributeRevenue(
GaugeType gaugeType,
uint256 amount
) external onlyRole(EMERGENCY_ADMIN) whenNotPaused {
if (amount == 0) revert InvalidAmount();
​
uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
uint256 performanceShare = amount * 20 / 100; // 20% performance fee
​
revenueShares[gaugeType] += veRAACShare;
// @audit missing performance fee accounting
_distributeToGauges(gaugeType, veRAACShare);
​
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);
}

GaugeController#511

Vulnerability Details

However, the function does not account for performance fees.

There is a state variable performanceFees in the GaugeController contract that is intended to store the total performance fees generated by the system but is left unused.

Impact

The performance fees generated by the system are not accounted for and are not distributed to the appropriate parties.

Tools Used

Manual Review

Recommendations

Create a function for distributing the performance fees and update the performanceFees state variable accordingly.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!