Core Contracts

Vulnerability Details

At BaseGauge the initial max and min amounts for boosts have incompatible values.

The thing is that the max is actually a smaller value than the min. See here.

Impact

Effectively DOSing core functions due to always revert on the _applyBoost() function.

This is because these min and max amounts are passed to the BoostCalculator::calculateBoost() logic, here. And inside there is a max - min operation, which will revert on underflow. Here.

Flow:

Some functions with the modifier:

• stake()

• withdraw()

• voteDirection()

Recommendations

Make max and min values sent to the BoostCalculator call in _applyBoost() in the same units. I looks like they both are percentages but with different decimals of precission. Be consistent with the units.

Boost calculator seems to use both as a percentage, see here, so I guess because of the division by 1e18 that the max amount should be scaled to the 1e18 precision.