when adding the gauge to the GaugeController, the gauge contract’s function setInitialWeight is not called to create the period based on initialWeight.
Summary
when adding the gauge to the GaugeController, the gauge contract’s function setInitialWeight is not called to create the period based on initialWeight. also, the gauge contract’s function setInitialWeight can only be called by GaugeController. But there is no way to call(not called) gauge contract’s function setInitialWeight by GaugeController. As a result, the period of the gauge will be different between GaugeController and gauge contract.
Vulnerability Details
1. When the function addGauge(contract GaugeController) is called , initialWeight is set to the gauge and the period of the gauge is created based on initialWeight.
**2. when adding the gauge to the GaugeController, the gauge contract’s function setInitialWeight is not called to create the period based on initialWeight . **
3. also, the gauge contract’s function setInitialWeight can only be called by GaugeController. But there is no way to call(not called) gauge contract’s function setInitialWeight by GaugeController.
Impact
** the period of the gauge will be different between GaugeController and gauge contract.**
Tools Used
manual review
Recommendations
when adding the gauge to the GaugeController, the gauge contract’s function setInitialWeight should be called to create the period based on initialWeight.
Lead Judging Commences
`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller
`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.