Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Boost multiplier is incorrectly applied to user's weight instead of user's liquidity locked.

alexczm

Summary

The boos multiplier is incorrectly applied to a weight amount instead to the user's LP. This will result in wrong reward distribution.

Vulnerability Details

BaseGauge::earned() should calculate the earned rewards for an account. The user's weight (which in fact it's gauge's weight) is multiplied by latest Reward Per Token - user's stored reward per token. The getRewardPerToken returns current reward per staked token.
At the end, user's accumulated rewards is summed.

function earned(address account) public view returns (uint256) {
return (getUserWeight(account) *
(getRewardPerToken() - userStates[account].rewardPerTokenPaid) / 1e18
) + userStates[account].rewards;
}

getUserWeight applies the boost to gauge's weight. Instead it should have been applied to user's LP.

function getUserWeight(address account) public view virtual returns (uint256) {
@> uint256 baseWeight = _getBaseWeight(account);
return _applyBoost(account, baseWeight); // @audit boost is applied incorrectly to gauge's weight.
}
​
function _getBaseWeight(address account) internal view virtual returns (uint256) {
@> return IGaugeController(controller).getGaugeWeight(address(this));//@audit returns current weight of gauge
}

When veRaac holders vote on gauge weights, they decide how much rewards each gauge receives. However, the user's boost should be applied to the user's staked amount in the gauge to incentivize liquidity provision.

For comparison, Curve's adjusted stake is computed using:

Adjusted Stake =

Where 2.5 is the maxBoost and 1.5 is maxBoost - minBoost.

Impact

The boosted amount is incrrrectly calculated. The rewards will not be distributed based on locked liquidity, disincentivizing LPing.

Tools Used

Recommendations

Apply the boost to user's staked amount.

function getUserWeight(address account) public view virtual returns (uint256) {
- uint256 baseWeight = _getBaseWeight(account);
- return _applyBoost(account, baseWeight);
+ return _applyBoost(account, _balances[account]);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge._getBaseWeight ignores account parameter and returns gauge's total weight, allowing users to claim rewards from gauges they never voted for or staked in

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge._getBaseWeight ignores account parameter and returns gauge's total weight, allowing users to claim rewards from gauges they never voted for or staked in

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!