Core Contracts

Summary:

The BaseGauge contract allows holders of veRAAC tokens to earn rewards without staking their tokens. This is due to the reward calculation logic, which calculates rewards based on user weight, including boost derived from veRAAC holdings, even if the user has no staked tokens. This leads to unfair reward distribution, as veRAAC holders can claim rewards without contributing to the gauge's staked capital.

Vulnerability Details:

1. Reward Calculation Based on User Weight: The earned function in BaseGauge calculates rewards based on getUserWeight, which in turn incorporates boost from veRAAC holdings via _applyBoost and BoostCalculator.calculateBoost.

2. No Staking Requirement: The earned function does not check if the user has staked any tokens. A user can hold veRAAC tokens, which grant them boost, and thus weight, without ever staking any stakingToken.

3. Instant Reward Claim: If rewardPerTokenStored is greater than 0 (meaning rewards have been distributed), a veRAAC holder can call getReward and claim rewards based on their veRAAC-derived weight, even if they have no staked tokens.

Impact:

• Unfair Reward Distribution: Users who stake their tokens and contribute to the gauge's capital are unfairly disadvantaged. veRAAC holders can effectively siphon rewards without any contribution.

• Discourages Staking: The ability to earn rewards without staking disincentivizes users from locking their tokens, which could negatively impact the gauge's total staked amount and its overall effectiveness.

• Potential for Abuse: Malicious actors could exploit this by acquiring veRAAC, claiming rewards without staking, effectively extracting value from the system without contributing.

Proof of Concept (PoC):

Scenario:

1. Alice stakes 100e18 tokens in the BaseGauge and holds 100e18 veRAAC. After a day, she earns some rewards.

2. Bluedragon acquires 100e18 veRAAC tokens but does not stake any tokens.

3. Because rewardPerTokenStored is now greater than 0 (due to Alice's staking and subsequent reward distribution), Bluedragon can call getReward and claim rewards based on their veRAAC holdings, even though they haven't staked any tokens. They effectively benefit from Alice's staking activity.

This scenario demonstrates how veRAAC holders can unfairly earn rewards without staking, diluting the rewards intended for actual stakers like Alice.

Proof Of Code:

1. Use this guide to intergrate foundry into your project: foundry

2. Create a new file FortisAudits.t.sol in the test directory.

3. Add the following gist code to the file: Gist Code

4. Run the test using forge test --mt test_FortisAudits_UnfairRewardDistribution -vvvv.

Tools Used:

• Manual code review

Recommended Mitigation:

Require Staking for Rewards: Modify the earned function in BaseGauge to check if a user has staked any tokens before calculating and distributing rewards. A simple check like _balances[account] > 0 would suffice.