Core Contracts

Summary

_applyBoost is meant to return the boosted weight value. The scaling that takes place is incorrect and causes the returned value to be far too small.

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/governance/gauges/BaseGauge.sol#L252
return (baseWeight * boost) / 1e18;
This calculation within _applyBoost is incorrect as boosts are meant to have precision of 1e5, indicated by the docs which state the minBoost should have a value of 10000

https://docs.raac.io/core/governance/boost/BoostController

As a result, the incorrect scaling in _applyBoost causes the weight to be numerous orders of magnitude lower than it otherwise should be.

_applyBoost <-- (called by) getUserWeight <-- (called by) earned <-- (called by) _updateReward <-- (called by) modifier updateReward

This modifier is used in the stake / withdraw / getReward / notifyRewardAmount / voteDirection / checkpoint functions, and as a result, each time one of those functions is called, _updateReward will be called due to the modifier, and due to this error, the amount of rewards earned by the account will be less than it otherwise should be.

Impact

A potential impact is that the user receives less rewards than is owed to them when they call getReward(), reducing the yield they receive from holding the staking token.
The likelihood is high as the issue will take place whenever the updateReward modifier is used, and it is used frequently.
The severity is high as it causes a direct loss of funds.

Tools Used

Manual review

Recommendations

Scale the calculation correctly by dividing by 1e5 (as that is the precision of boosts).