Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

BaseGauge::updatePeriod calculate wrong nextPeriodStart

josh4324

Summary

The updatePeriod function updates the period, ensuring that the new period starts after the previous one has elapsed. However, the logic used to compute nextPeriodStart incorrectly sets the new nextPeriodStart two periods ahead instead of one.

Vulnerability Details

function updatePeriod() external override onlyController {
uint256 currentTime = block.timestamp;
uint256 periodEnd = periodState.periodStartTime + getPeriodDuration();
if (currentTime < periodEnd) {
revert PeriodNotElapsed();
}
​
uint256 periodDuration = getPeriodDuration();
// Calculate average weight for the ending period
uint256 avgWeight = periodState.votingPeriod.calculateAverage(periodEnd);
// Calculate the start of the next period (ensure it's in the future)
uint256 nextPeriodStart = ((currentTime / periodDuration) + 2) * periodDuration;
// Reset period state
periodState.distributed = 0;
periodState.periodStartTime = nextPeriodStart;
​
// Create new voting period
TimeWeightedAverage.createPeriod(
periodState.votingPeriod,
nextPeriodStart,
periodDuration,
avgWeight,
WEIGHT_PRECISION
);
}
​

currentTime / periodDuration determines the number of completed periods.

Adding 2 before multiplying by periodDuration incorrectly pushes the next period two full periods ahead.

The correct formula should be:

uint256 nextPeriodStart = ((currentTime / periodDuration) + 1) * periodDuration;

Impact

The next period is delayed by an entire additional period.

POC

Assume periodDuration = 30 days.

Suppose currentTime = 31 days (just after the previous period ended).

currentTime / periodDuration = 1 (completed periods count).

With the current implementation:

nextPeriodStart = (1 + 2) * 30 = 90 days

The next period incorrectly starts at day 90, instead of day 60.

The correct implementation:

nextPeriodStart = (1 + 1) * 30 = 60 days

The next period now correctly starts at day 60, immediately after the previous period.

Tools Used

Manual Review

Recommendations

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::updatePeriod uses ((currentTime / periodDuration) + 2) calculation causing entire reward periods to be skipped, resulting in permanent loss of user rewards

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::updatePeriod uses ((currentTime / periodDuration) + 2) calculation causing entire reward periods to be skipped, resulting in permanent loss of user rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.