Core Contracts

Summary

The distributeRevenue function in the GaugeController contract calculates a 20% performance fee but fails to store or distribute it. This oversight results in the loss of the performance fee portion, as it is neither allocated to gauges nor recorded for future use.

Vulnerability Details

In the distributeRevenue function, the protocol intends to split revenue into two parts:

1. 80% to veRAAC holders (distributed immediately to gauges)

2. 20% as a performance fee (presumably for yield products)

However, the code only processes the 80% share (veRAACShare), while the 20% performanceShare is merely emitted in an event. The performanceFees mapping (declared as mapping(address => uint256) public performanceFees) is never updated, leaving the performance fee unaccounted for.

Proof of Concept (PoC):

1. Assume distributeRevenue is called with amount = 100 ETH.

2. veRAACShare = 80 ETH is distributed to gauges.

3. performanceShare = 20 ETH is emitted but not stored or sent anywhere.

4. The performanceFees mapping remains unchanged, and the 20 ETH is effectively lost.

Impact

The 20% performance fee is permanently lost from the protocol’s revenue stream. For example, in a $1M revenue distribution, $200,000 would vanish.

Tools Used

Manual Review

Recommendation

Update the distributeRevenue function to properly handle the performance fee.