Core Contracts

Summary

The BaseGauge contract constructor initializes boostState.minBoost with a value (1e18) that is significantly larger than maxBoost (25000), which breaks the boost calculation logic.

Vulnerability Details

The minBoost value of 1e18 is significantly larger than the maxBoost value of 25000, which breaks the intended boost calculation logic where minBoost should represent 1x (10000) and maxBoost should represent 2.5x (25000).

in the constructor:

Impact

The incorrect minBoost value will cause the boost calculation to malfunction since:

• minBoost (1e18) > maxBoost (25000)

• This breaks the calculateBoost function in the BoostCalculator library BoostCalculator::calculateBoost

  and cause an underflow revert error due to uint256 boostRange = params.maxBoost - params.minBoost;

  function calculateBoost(

  uint256 veBalance,

  uint256 totalVeSupply,

  BoostParameters memory params

  ) internal pure returns (uint256) {

  // Return base boost (1x = 10000 basis points) if no voting power

  if (totalVeSupply == 0) {

  return params.minBoost;

  }

  ​

  // Calculate voting power ratio with higher precision

  uint256 votingPowerRatio = (veBalance * 1e18) / totalVeSupply;

  // Calculate boost within min-max range

  ---> this will always cays it to revert>> uint256 boostRange = params.maxBoost - params.minBoost;

  uint256 boost = params.minBoost + ((votingPowerRatio * boostRange) / 1e18);

  ...rest of the code

  }

Tools Used

Manual code review

Recommendations

Fix the boost parameters:

boostState.minBoost = 10000; // 1x base