Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`distributeRevenue` will revert most of the times

pyro

Summary

distributeRevenue will revert most of the times due to a for loop with miscalculated amounts.

Vulnerability Details

notifyRewardAmount is used by the gauge controller to increase the rewards for this gauge. Where if the reward surpass periodState.emission or the contract balance, the TX reverts.

function notifyRewardAmount(uint256 amount) external override onlyController updateReward(address(0)) {
if (amount > periodState.emission) revert RewardCapExceeded();
​
// amount / 7 days
rewardRate = notifyReward(periodState, amount, periodState.emission, getPeriodDuration());
periodState.distributed += amount;
​
uint256 balance = rewardToken.balanceOf(address(this));
if (rewardRate * getPeriodDuration() > balance) { // 7 days
revert InsufficientRewardBalance();
}
​
lastUpdateTime = block.timestamp;
emit RewardNotified(amount);
}

With than in mind when we look into how _distributeToGauges calls each gauge notifyRewardAmount we can spot an issue.

for (uint256 i = 0; i < _gaugeList.length; i++) {
address gauge = _gaugeList[i];
if (gauges[gauge].isActive && gauges[gauge].gaugeType == gaugeType) {
uint256 gaugeShare = (amount * gaugeWeights[i]) / totalTypeWeight;
if (gaugeShare > 0) {
​
//@audit If one of those gauges has reached the max emisions the whole TX fails
// calculate how much it needs to reach the max emission threshold and notify that
IGauge(gauge).notifyRewardAmount(gaugeShare);
}
}
}

Even if 1 of these gauges doesn't have enough balance of it's reward token, or if it surpasses it's periodState.emission the whole TX would revert.

Impact

_distributeToGauges will revert most of the time, preventing revenue distributions

Tools Used

Manual review

Recommendations

Either add this statement up into a catch block. Yo can also do some calculation in the for loop to make sure the vault has balance and the new amount won't breach the emission cap, if it violates one of the 2, either skip it or lower the amount

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::updatePeriod doesn't call the gauge's updatePeriod function, preventing periodState.distributed from resetting and eventually causing distributeRewards to permanently fail

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::updatePeriod doesn't call the gauge's updatePeriod function, preventing periodState.distributed from resetting and eventually causing distributeRewards to permanently fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!