Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect rewards calculation in GaugeController::_calculateReward

x1485967

Summary

Incorrect rewards calculation in GaugeController::_calculateReward

Vulnerability Details

In GaugeController, we will distribute gauge rewards. We will distribute 1000000 * 1018 monthly rewards to the RWA gauges. And distribute 250000 * 1018 rewards to the RAAC gauges.

When we calculate one gauge's rewards amount, we should calculate the weight ratio in the same gauge type. For example, if gauge A is one RWA gauge, and gauge A' weight is 50% of all RWA gauge weights. Then gauge A will receive 1000000 * 10**18 / 2 rewards.

The problem here is that we use the incorrect calculation (periodEmission * gaugeShare * typeShare) / (WEIGHT_PRECISION * WEIGHT_PRECISION). Based on the above example, assume the RWA gauge's weight is 50% of the total gauges: the calculated rewards for gauge A equal 1000000 * 10**18 * 2500 * 5000 / (10000 * 10000) = 1000000 * 10**18 / 8.

function _calculateReward(address gauge) internal view returns (uint256) {
Gauge storage g = gauges[gauge];
uint256 totalWeight = getTotalWeight();
if (totalWeight == 0) return 0;
uint256 gaugeShare = (g.weight * WEIGHT_PRECISION) / totalWeight;
uint256 typeShare = (typeWeights[g.gaugeType] * WEIGHT_PRECISION) / MAX_TYPE_WEIGHT;
uint256 periodEmission = g.gaugeType == GaugeType.RWA ? _calculateRWAEmission() : _calculateRAACEmission();
return (periodEmission * gaugeShare * typeShare) / (WEIGHT_PRECISION * WEIGHT_PRECISION);
}
​

Impact

The reward distribution calculation is incorrect. This will cause that users will get less rewards than expected.

Tools Used

Manual

Recommendations

Use the correct formula for this reward calculation.

- return (periodEmission * gaugeShare * typeShare) / (WEIGHT_PRECISION * WEIGHT_PRECISION);
+ return (periodEmission * gaugeShare * WEIGHT_PRECISION) / (WEIGHT_PRECISION * typeShare);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::_calculateReward uses combined weight of all gauge types instead of type-specific weights, causing incorrect reward distribution between RWA and RAAC gauges

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::_calculateReward uses combined weight of all gauge types instead of type-specific weights, causing incorrect reward distribution between RWA and RAAC gauges

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.