Core Contracts

Summary

The notifyRewardAmount function in the BaseGauge contract fails to validate the total distribution against the distributionCap. Although the function checks the emission limit, it does not ensure that the cumulative rewards distributed do not exceed the predefined distributionCap. This missing validation allows potential over-distribution of rewards, which can disrupt the intended economic balance of the protocol.

Vulnerability Details

The contract includes a distributionCap variable, designed to limit the total amount of rewards distributed. However, the notifyRewardAmount function does not reference or enforce this cap when updating periodState.distributed .

Key Issues Identified:

• The notifyRewardAmount function checks if the amount exceeds periodState.emission but not the distributionCap.

• The notifyReward internal function validates emission constraints but does not consider the global distributionCap.

• As a result, multiple calls to notifyRewardAmount could cumulatively surpass the distributionCap, leading to unintended reward overflows.

Impact

• Excessive Reward Distribution: The total distributed rewards may surpass the intended cap, potentially diluting the token’s value and disrupting the reward mechanism.

• 🔓 Protocol Fund Drain: Over-distribution could prematurely deplete the protocol’s reward reserves, preventing future rewards from being properly distributed.

Tools Used

Manual Review

Recommendations

Introduce a validation check in the notifyRewardAmount function to ensure that the sum of periodState.distributed and the new amount does not exceed the distributionCap.