Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

GaugeController._calculateReward returns smaller reward amount

glightspeed2

Summary

GaugeController._calculateReward returns smaller reward amount

Vulnerability Details

When GauigeController distributes reward, individual gauge's reward amount is calculated from GaugeController._calculateReward function:

function _calculateReward(address gauge) internal view returns (uint256) {
Gauge storage g = gauges[gauge];
uint256 totalWeight = getTotalWeight();
if (totalWeight == 0) return 0;
uint256 gaugeShare = (g.weight * WEIGHT_PRECISION) / totalWeight;
uint256 typeShare = (typeWeights[g.gaugeType] * WEIGHT_PRECISION) / MAX_TYPE_WEIGHT;
// Calculate period emissions based on gauge type
uint256 periodEmission = g.gaugeType == GaugeType.RWA ? _calculateRWAEmission() : _calculateRAACEmission();
@> return (periodEmission * gaugeShare * typeShare) / (WEIGHT_PRECISION * WEIGHT_PRECISION); // @audit should not mulitplied by `typeShare`
}

The function calculates period emissions based on gauge type and type share.

The problem is that since RWA gauges and RAAC gauges use different emission rate, individual gauge's share should not be multiplied by typeShare.

For example, let's assume there are two gauges: RAACGauge and RWA Gauge, and type weights are set to 0.5 and 0.5 as in GaugeController's constructor. And RAACEmission is 250k per week and RWAEmission is 1M per month.

What will happen is that RAACGauge will receive 125k per week and RWAGauge will receive 0.5M per month.

Impact

Any unclaimed rewards will be stuck at protocol

Recommendation

No need to multiply periodEmission by typeShare

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::_calculateReward uses combined weight of all gauge types instead of type-specific weights, causing incorrect reward distribution between RWA and RAAC gauges

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::_calculateReward uses combined weight of all gauge types instead of type-specific weights, causing incorrect reward distribution between RWA and RAAC gauges

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::_calculateReward redundantly multiplies by typeShare causing reward reduction since periodEmission is already type-specific

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!