Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing reward token transfer in GaugeController leads to failed reward distribution to gauges

uddercover

Summary

The GaugeController contract calls notifyRewardAmount on gauges but never actually transfers the reward tokens to them first. This causes the gauge's reward distribution to fail due to insufficient balance checks.

Vulnerability Details

In GaugeController.sol, when distributing rewards, the `BaseGauge::notifyRewardAmount` function is called with no actual transfer of the tokens to distribute.

As such, the call to `notifyRewardAmount` would always revert since no tokens are transferred. `notifyRewardAmount` also has no functionality for transferring from the GaugeController, making it very unlikely for the reward distribution to proceed.

function notifyRewardAmount(uint256 amount) external override onlyController updateReward(address(0)) {
if (amount > periodState.emission) revert RewardCapExceeded();
​
rewardRate = notifyReward(periodState, amount, periodState.emission, getPeriodDuration());
periodState.distributed += amount;
​
uint256 balance = rewardToken.balanceOf(address(this));
@> if (rewardRate * getPeriodDuration() > balance) {
revert InsufficientRewardBalance();
}
​
lastUpdateTime = block.timestamp;
emit RewardNotified(amount);
}

Impact

Gauges don't actually receive rewards as all reward notifications will revert

Tools Used

Manual review

Recommendations

Add functionality to transfer reward tokens from the to the BaseGauge contract (and indirectly the contracts that inherit it)

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!