Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Two roles are given the same permission to deactivate gauges in the controller contract

minusone

Summary

Two roles are given the same permission to deactivate gauges in the controller contract

Vulnerability Details

observe the following 2 snippets of code

/**
* @notice Emergency shuts down a gauge
* @dev Only callable by emergency admin
* @param gauge Address of gauge to shut down
*/
function emergencyShutdown(address gauge) external {
if (!hasRole(EMERGENCY_ADMIN, msg.sender)) revert UnauthorizedCaller();
if (!isGauge(gauge)) revert GaugeNotFound();
gauges[gauge].isActive = false;
emit EmergencyShutdown(gauge, msg.sender);
}

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/gauges/GaugeController.sol#L438-L448

/**
* @notice Toggles active status of a gauge
* @dev Only callable by gauge admin
* @param gauge Address of gauge to toggle
*/
function toggleGaugeStatus(address gauge) external onlyGaugeAdmin {
if (!isGauge(gauge)) revert GaugeNotFound();
gauges[gauge].isActive = !gauges[gauge].isActive;
emit GaugeStatusUpdated(gauge, gauges[gauge].isActive);
}
​

The ability to deactivate guages is given to 2 separate roles; the gauge admin and the emergency admin.

Impact

It is possiblie that the guageadmin is not authorized to deactivate gauges

Tools Used

manual review

Recommendations

Restrict the ability to deactivate gauge to just the owner is the gauge admin is not authorized to do so

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.