Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect minBoost value in BaseGauge constructor causes all reward boost calculations to revert making users unable to claim rewards

uddercover

Summary

The BaseGauge contract initializes boostState.minBoost to 1e18 instead of 10000 (1x in basis points). This causes the _applyBoost function's boost calculation to fail due to arithmetic underflow when subtracting minBoost from maxBoost in the BoostCalculator::calculateBoost function.

Vulnerability Details

In BaseGauge::constructor, the boost parameters are initialized incorrectly:

constructor(...) {
// ...
boostState.maxBoost = 25000; // 2.5x
boostState.minBoost = 1e18; // Should be 10000
// ...
}

This value is then used in `BaseGauge::_applyBoost` which passes it on to BoostCalculator::calculateBoost:

function calculateBoost(...) internal pure returns (uint256) {
// ...
uint256 boostRange = params.maxBoost - params.minBoost; // Reverts due to underflow
// ...
}

POC

  1. BaseGauge is deployed with minBoost = 1e18 and maxBoost = 25000

  2. User calls BaseGauge::stake to stake tokens

  3. When calculating rewards via BaseGauge::earned, it calls getUserWeight

  4. getUserWeight calls _applyBoost which uses BoostCalculator::calculateBoost

  5. The calculation 25000 - 1e18 reverts due to underflow since maxBoost is much smaller than minBoost

Impact

All reward calculations will fail due to the revert in boost calculations making users unable to earn or claim rewards. The gauge system becomes non-functional

Tools Used

Manual review

Recommendations

Fix the minBoost value in the constructor:

- boostState.minBoost = 1e18;
+ boostState.minBoost = 10000; // 1x in basis points
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

boostState.minBoost is set to 1e18

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!