Submission Details
Severity:
The minBoost in BaseGauge.sol is with wrong amount, which would lead to always reverting in the calculations.
Summary
The developers mistyped boostState.minBoost = 1e4, instead they wrote boostState.minBoost = 1e18
Vulnerability Details
constructor(
address \_rewardToken,
address \_stakingToken,
address \_controller,
uint256 \_maxEmission,
uint256 \_periodDuration
) {
rewardToken = IERC20(\_rewardToken);
stakingToken = IERC20(\_stakingToken);
controller = \_controller;
// Initialize roles
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(CONTROLLER_ROLE, _controller);
// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
boostState.minBoost = 1e18; //< = issue
boostState.boostWindow = 7 days;
uint256 currentTime = block.timestamp;
uint256 nextPeriod = ((currentTime / _periodDuration) * _periodDuration) + _periodDuration;
// Initialize period state
periodState.periodStartTime = nextPeriod;
periodState.emission = _maxEmission;
TimeWeightedAverage.createPeriod(
periodState.votingPeriod,
nextPeriod,
_periodDuration,
0,
10000 // VOTE_PRECISION
);
}
This would lead to reverting in the calculateBoost becuase of this line:
BoostCalculator.BoostParameters memory params = BoostCalculator.BoostParameters({
maxBoost: boostState.maxBoost,
minBoost: boostState.minBoost, //18
boostWindow: boostState.boostWindow,
totalWeight: boostState.totalWeight,
totalVotingPower: boostState.totalVotingPower,
votingPower: boostState.votingPower
});
uint256 boost = BoostCalculator.calculateBoost(veBalance, totalVeSupply, params);//<= here
function calculateBoost(uint256 veBalance, uint256 totalVeSupply, BoostParameters memory params)
internal
pure
returns (uint256)
{
//code
uint256 boostRange = params.maxBoost - params.minBoost; // 1e4 - 1e18 @audit it will always revert
//code
}
Impact
you can never use applyBoost function
Tools Used
Recommendations
BoostState.minBoost has to be equal to 1e4
Updates
Lead Judging Commences
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
boostState.minBoost is set to 1e18
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.