Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect initialization of minBoost or maxBoost in `BaseGuage` contract's constructor.

orangesantra

Summary

The constructor initialization in BaseGuage.sol is as follow -

constructor(
address _rewardToken,
address _stakingToken, // $mynotes - _stakingToken is veRAAC.
address _controller,
uint256 _maxEmission,
uint256 _periodDuration
) {
rewardToken = IERC20(_rewardToken);
stakingToken = IERC20(_stakingToken);
controller = _controller;
// Initialize roles
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(CONTROLLER_ROLE, _controller);
// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
@-> boostState.minBoost = 1e18; // @audit - incorrect initilization.
boostState.boostWindow = 7 days;
​
uint256 currentTime = block.timestamp;
​
uint256 nextPeriod = ((currentTime / _periodDuration) * _periodDuration) + _periodDuration;
// Initialize period state
periodState.periodStartTime = nextPeriod;
periodState.emission = _maxEmission;
​
TimeWeightedAverage.createPeriod(
periodState.votingPeriod, // empty object
nextPeriod, // $mynotes - startTime
_periodDuration, // $mynotes - duration
0, // $mynotes - initialValue
10000 // VOTE_PRECISION // $mynotes - weight
);
}

The maxBoost = 25000 and minBoost = 1e18, which is totally incorrect as minimum value is greater than maximum value.

Vulnerability Details

This incorrect initilization of min and max boost will lead to reverting of calculateBoost(), because of line -

uint256 boostRange = params.maxBoost - params.minBoost;

As, (25000 - 1e18) will always revert.

Code snippet of calculateBoost() function.

function calculateBoost(
uint256 veBalance,
uint256 totalVeSupply,
BoostParameters memory params
) internal pure returns (uint256) {
// Return base boost (1x = 10000 basis points) if no voting power
if (totalVeSupply == 0) {
return params.minBoost;
}
​
// Calculate voting power ratio with higher precision
uint256 votingPowerRatio = (veBalance * 1e18) / totalVeSupply;
// Calculate boost within min-max range
@ -> uint256 boostRange = params.maxBoost - params.minBoost;
uint256 boost = params.minBoost + ((votingPowerRatio * boostRange) / 1e18);
// Ensure boost is within bounds
if (boost < params.minBoost) {
return params.minBoost;
}
if (boost > params.maxBoost) {
return params.maxBoost;
}
return boost;
}

Impact

  1. calculateBoost() function is necessary for determining reward for user. if this function will revert, it means user funds
    stuck.

  2. Also boost update function will not work, as it's also dependent on calculateBoost().

Tools Used

Manual

Recommendations

Change -

- boostState.maxBoost = 25000; // 2.5x
+ boostState.maxBoost = 25 * 1e17; // 2.5x
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

boostState.minBoost is set to 1e18

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.