Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Different precisions used for maxBoost and minBoost in BaseGauge

DRUGstore

Summary

The BaseGauge contract contains a critical precision inconsistency in its boost parameter initialization. The maxBoost and minBoost values use different decimal precisions, leading to unintended behavior where minBoost is effectively greater than maxBoost.

Vulnerability Details

The issue is located in the BaseGuage constructor:

// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
boostState.minBoost = 1e18; //@audit - different decimals are used here and also minBoost>maxBoost because of it

The problems are:

  1. maxBoost uses a precision of 1e4 (25000 represents 2.5x)

  2. minBoost uses a precision of 1e18 (1e18 represents 1x)

  3. Due to different precisions, minBoost is effectively much larger than maxBoost

  4. This inconsistency will cause incorrect boost calculations throughout the system.

The following is one instance where these variables are used in calculations:

function _applyBoost(
//@note: audit done
address account,
uint256 baseWeight
) internal view virtual returns (uint256) {
if (baseWeight == 0) return 0;
​
IERC20 veToken = IERC20(IGaugeController(controller).veRAACToken());
uint256 veBalance = veToken.balanceOf(account);
uint256 totalVeSupply = veToken.totalSupply();
​
// Create BoostParameters struct from boostState
BoostCalculator.BoostParameters memory params = BoostCalculator
.BoostParameters({
maxBoost: boostState.maxBoost,
minBoost: boostState.minBoost,
boostWindow: boostState.boostWindow,
totalWeight: boostState.totalWeight,
totalVotingPower: boostState.totalVotingPower,
votingPower: boostState.votingPower
});
​
uint256 boost = BoostCalculator.calculateBoost(
veBalance,
totalVeSupply,
params
);
​
return (baseWeight * boost) / 1e18;
}

Impact

This vulnerability has several negative consequences:

  1. Boost calculations will produce incorrect results

  2. Users may receive incorrect voting power allocations

  3. Reward distributions will be inaccurate

  4. The protocol's governance mechanism may behave unpredictably

  5. Potential economic losses for users due to incorrect boost calculations

Tools Used

Manual review

Recommendations

Standardize boost precision to 1e18 throughout the system (and in all the calculations involving minBoost and maxBoost):

// Use consistent 1e18 precision
boostState.maxBoost = 2.5e18; // 2.5x
boostState.minBoost = 1e18; // 1x

Add validation checks to ensure minBoost <= maxBoost:

require(
boostState.minBoost <= boostState.maxBoost,
"minBoost must be <= maxBoost"
);
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

boostState.minBoost is set to 1e18

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.