Core Contracts

Summary

**when a gauge’s reward amount is calculated in function _calculateReward for a period, periodEmission is multiplied with typeShare which will return the gaugetype reward for this period . afterthat, (periodEmission * typeShare) is multiplied with gaugeShare which is incorrect. Here the gauge’s gaugeType total weight should be calculated . then gaugeShare should be calculated based on gaugeType total weight. But as here (periodEmission * typeShare) is multiplied with gaugeShare(which is calculated based on all gauge’s total weight), as a result every gauge will get rewards/emission amounts less than expected. **

Vulnerability Details

1. Let’s assume, there are two gauges i.e gauge1(gaugeType RWA) and gauge2(gaugeType RAAC) in the GaugeControlle contract. Currently typeWeights[GaugeType.RWA] = 5000 i.e 50% and typeWeights[GaugeType.RAAC] = 5000 i.e 50%. Currently assume totalWeight = 1000e18 where gauge1’s weight is 500 and gauge2’s weight is 500e18.

2. now the function distributeRewards is called for gauge1 which calls the function _calculateReward where gaugeShare = 500*10000/1000 = 5000. typeShare = 5000*10000/10000 = 5000. periodEmission = 1000000e18. So total rewards = (1000000e18*5000*5000)/(10000*10000) = 250000e18.

3. Similarly, gauge2 weekly emission reward is 62500e18 , so gauge2’s monthly emission reward is 250000e18.

4. so, gauge1’s and gauge2’s total monthly emission reward is 500000e18 . but in reality gauge1’s and gauge2’s total monthly emission reward should be 1000000e18. Here 50% of 1000000e18 should be rewarded for GaugeType.RWA(as typeweight 50%) and 50% of 1000000e18 should be rewarded for gaugeType RAAC(as typeweight 50%) in a month.

\

Impact

every gauge will get rewards/emission amounts less than expected.

Tools Used

manual review

Recommendations

Here the gauge’s gaugeType total weight should be calculated . then gaugeShare should be calculated based on gaugeType total weight.