Submission Details
Severity:
Incorrect periodEmission calculations leads to incorrect rewards distribution
Summary
Rewards amount miscalculated in _calculateReward due to periodEmission's wrong application.
Vulnerability Details
The calculateReward calculates the reward of a gauge when called from the distributeRewards
function _calculateReward(address gauge) internal view returns (uint256) {
Gauge storage g = gauges[gauge];
uint256 totalWeight = getTotalWeight();
if (totalWeight == 0) return 0;
uint256 gaugeShare = (g.weight * WEIGHT_PRECISION) / totalWeight;
uint256 typeShare = (typeWeights[g.gaugeType] * WEIGHT_PRECISION) / MAX_TYPE_WEIGHT;
// Calculate period emissions based on gauge type
@> uint256 periodEmission = g.gaugeType == GaugeType.RWA ? _calculateRWAEmission() : _calculateRAACEmission();
return (periodEmission * gaugeShare * typeShare) / (WEIGHT_PRECISION * WEIGHT_PRECISION);
}
The problem here is that the function tries to scale the periodEmission , this however is wrong as the returned value has already been scaled based on the gaugeType
RWA
function _calculateRWAEmission() internal view returns (uint256) {
// Monthly RWA emission calculation
// This should be implemented based on your tokenomics
return 1000000 * 10**18; // Example value
}
RAAC
function _calculateRAACEmission() internal view returns (uint256) {
// Weekly RAAC emission calculation
// This should be implemented based on your tokenomics
return 250000 * 10**18; // Example value
}
This means that the code will return wrong values to to the calculations.
Impact
Incorrect periodEmission leads to incorrect rewards distribution.
Tools Used
Manual review.
Recommendations
The issue can be mitigated like :
function _calculateReward(address gauge) internal view returns (uint256) {
Gauge storage g = gauges[gauge];
uint256 totalWeight = getTotalWeight();
if (totalWeight == 0) return 0;
uint256 gaugeShare = (g.weight * WEIGHT_PRECISION) / totalWeight;
// Calculate period emissions based on gauge type
uint256 periodEmission = g.gaugeType == GaugeType.RWA ? _calculateRWAEmission() : _calculateRAACEmission();
@> return (periodEmission * gaugeShare) / WEIGHT_PRECISION;
}
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
GaugeController uses hardcoded placeholder emission values in _calculateRWAEmission() and _calculateRAACEmission() instead of actual tokenomics-based rates
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.