Core Contracts

Summary:

The BaseGauge.getUserWeight() function, reverts when applying boost calculation to an user, due to an incorrect configuration of minimum and maximum boost values. This leads to an underflow during boost range calculation within the BoostCalculator library, ultimately causing denial of service to reward distribution. Specifically, the minBoost value (1e18) is greater than the maxBoost value (25000), which results in a panic revert.

Vulnerability Details:

1. Incorrect Boost Configuration: In the BaseGauge constructor, the boostState is initialized with maxBoost = 25000 and minBoost = 1e18. This configuration is incorrect because minBoost is significantly larger than maxBoost.

2. Underflow in Boost Calculation: The BoostCalculator.calculateBoost function (called by _applyBoost in BaseGauge) calculates a boostRange using the formula params.maxBoost - params.minBoost. When minBoost is greater than maxBoost, this calculation results in an underflow, causing a revert.

3. DoS of Reward Distribution: The getUserWeight function in BaseGauge uses the result of _applyBoost (which is affected by the underflow) to determine a user's weight. As this weight is then used in the earned function to calculate the user's reward. But due to the underflow, the reward distribution logic is disrupted, potentially leading to a denial of service.

List of functions affected:

• BasGauge.stake

• BaseGauge.withdraw

• BaseGauge.getReward

• BaseGauge.voteDirection

• BaseGauage.earned

Relevant Code Snippets:

• BaseGauge Constructor

• BoostCalculator.calculateBoost

Impact:

As the getUserWeight function reverts due to the underflow in boost calculation, this weight is used in updateReward modifier to calculate the user's reward. This leads to a denial of service in the reward distribution mechanism, affecting the staking and reward claiming process. Thus eventually causing a total denial of service to the reward distribution mechanism.

Proof of Concept (PoC):

1. Alice stakes 100 staking tokens in the RAACGauage contract.

2. The updateRewad modifier is invoked, which calls the getUserWeight function to calculate the user's weight for calculating rewards.

3. The getUserWeight function calls the _applyBoost function, which in turn calls the BoostCalculator.calculateBoost function.

4. Due to the incorrect configuration of minBoost and maxBoost, the boostRange calculation underflows, causing a revert in the calculateBoost function.

5. As a result, the getUserWeight function reverts, the whole stake tx fails, causing a denial of service.

Proof Of Code:

1. Use this guide to intergrate foundry into your project: foundry

2. Create a new file FortisAudits.t.sol in the test directory.

3. Add the following gist code to the file: Gist Code

4. Run the test using forge test --mt test_FortisAudit_UnderflowInRewardCalculation -vvvv.

Tools Used:

• Manual code review

Recommended Mitigation:

To prevent the underflow in boost calculation, ensure that the minBoost value is less than the maxBoost value. This will prevent the underflow in the calculateBoost function and allow the reward distribution mechanism to function correctly.