Submission Details
Severity:
Inconsistent scaling in boost parameters initialization causes incorrect min/max relationship
[M-1] Inconsistent scaling in boost parameters initialization causes incorrect min/max relationship
Description:
In BaseGauge's constructor, boost parameters use inconsistent scaling:
constructor(...) {
boostState.maxBoost = 25000; // 2.5x in basis points (10000 = 1.0x)
boostState.minBoost = 1e18; // 1.0x in WAD precision
}
minBoost in WAD (1e18) is significantly larger than maxBoost in basis points (25000), inverting their intended relationship.
Impact:
Invalid boost range where minimum exceeds maximum
Potential revert or incorrect calculations in boost-related functions
Breaks core boost mechanism assumptions
Proof of Concept:
constructor(
// @zeroaddresscheck
address _rewardToken,
address _stakingToken,
address _controller,
uint256 _maxEmission,
uint256 _periodDuration
) {
rewardToken = IERC20(_rewardToken);
stakingToken = IERC20(_stakingToken);
controller = _controller;
// Initialize roles
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(CONTROLLER_ROLE, _controller);
// Initialize boost parameters
// @audit minboost is more than maxboost
boostState.maxBoost = 25000; // 2.5x
boostState.minBoost = 1e18; // vulnerable line
boostState.boostWindow = 7 days;
uint256 currentTime = block.timestamp;
uint256 nextPeriod = ((currentTime / _periodDuration) * _periodDuration) + _periodDuration;
// Initialize period state
periodState.periodStartTime = nextPeriod;
periodState.emission = _maxEmission;
TimeWeightedAverage.createPeriod(
periodState.votingPeriod,
nextPeriod,
_periodDuration,
0,
10000 // VOTE_PRECISION
);
}
Recommendation:
Use consistent scaling for both parameters - either both in basis points or both in WAD precision.
// Current (incorrect):
boostState.maxBoost = 25000; // 2.5x basis points
boostState.minBoost = 1e18; // 1 WAD (much larger than 25000)
// Should be either:
// Option 1 - Both in basis points
boostState.maxBoost = 25000; // 2.5x
boostState.minBoost = 10000; // 1.0x
// Option 2 - Both in WAD
boostState.maxBoost = 2.5e18; // 2.5x
boostState.minBoost = 1e18; // 1.0x
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
boostState.minBoost is set to 1e18
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.