Core Contracts

Relevant Context

The BaseGauge contract implements a boost mechanism where users can receive increased rewards based on their veToken balance. The boost multiplier is meant to range from 1x (minimum) to 2.5x (maximum). The GaugeController contract is responsible for managing gauge parameters and configurations.

Finding Description

In BaseGauge#constructor, the maxBoost parameter is incorrectly initialized as 25000 while minBoost is set to 1e18. When BoostCalculator#calculateBoost attempts to calculate boostRange = params.maxBoost - params.minBoost, the subtraction will revert due to underflow since 25000 - 1e18 is negative.

Critically, while BaseGauge has a setBoostParameters function to fix this issue, this function can only be called by the controller. However, the GaugeController contract does not implement any function to call setBoostParameters on gauges, meaning there is no way to correct the initialization error once a gauge is deployed.

This creates a permanent denial of service condition as there is no recovery path to fix the incorrect boost parameters.

Impact Explanation

High. The contract becomes permanently unusable as:

1. Core functionality reverts due to incorrect boost parameters

2. No mechanism exists to correct these parameters

3. New gauges must be deployed to fix the issue, disrupting the entire gauge system

Likelihood Explanation

High. This affects every transaction that involves reward calculations and there is no way to avoid or fix the issue without redeploying the contracts.

Proof of Concept

1. User Alice attempts to stake tokens in the gauge by calling stake(100e18)

2. stake function has updateReward modifier which calls _updateReward

3. Inside _updateReward:

   if (account != address(0)) {

   UserState storage state = userStates[account];

   state.rewards = earned(account); // This line triggers the revert

   ...

   }

4. Transaction reverts due to underflow in boost calculation

5. Admin attempts to fix by calling setBoostParameters through controller

6. No such function exists in GaugeController

7. Gauge remains permanently broken

Recommendation

1. Fix the initialization values:

1. Add boost parameter management to GaugeController:

This ensures both correct initialization and the ability to adjust parameters if needed.