Core Contracts

Summary

The distributeRewards() function in GaugeController fails to transfer reward tokens to the gauge contract before notifying it of the reward amount. This results in a guaranteed revert in BaseGauge.notifyRewardAmount() due to insufficient balance, making reward distribution non-functional in its current implementation.

Vulnerability Details

Issue in distributeRewards() Function:

GaugeController.distributeRewards() distributes rewards to a gauge if reward != 0:

GaugeController.sol#L329-L332

However, it does not transfer reward tokens to the gauge before this call. This leads to a failure in BaseGauge.notifyRewardAmount(), specifically at:

BaseGauge.sol#L360-L363

Since balance (the gauge’s token balance) is zero or insufficient, the function will always revert.

Expected Behavior:

1. GaugeController should hold reward tokens.

2. Before calling notifyRewardAmount(), it should transfer the calculated reward amount to the gauge.

3. The gauge contract can then properly update its reward rate without reversion.

Note: The similar issue is also evident in GaugeController._distributeToGauges() when distributing rewards to gauges of a specific type.

Impact

• Rewards will not be sent, affecting incentives.

• Transactions will fail due to missing funds.

• Requires manual funding, making the process inefficient.

• The system relies on an unverified external funding process.

Tools Used

Manual

Recommendations

1. Fix distributeRewards() to Transfer Rewards First

Modify the function to first transfer reward tokens to the gauge before notifying it.

Fixed Code:

This ensures that:

• The gauge has the required balance before notifyRewardAmount().

• rewardRate can be properly set without reversion.

2. Implement a Pre-Funding Check (Alternative Approach)

If funding is meant to be handled separately, the contract should:

• Require a minimum balance before calling notifyRewardAmount().

• Implement an explicit funding function to deposit rewards in advance.

• Emit an event for missing funds instead of causing a revert.

Example Pre-Funding Check:

This prevents unnecessary transaction failures and allows governance to track missing funding.