Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect gauge reward calculation in BaseGauge

x1485967

Summary

Incorrect gauge reward calculation in BaseGauge

Vulnerability Details

In BaseGauge, we will update users' rewards via _updateReward. When the admin distributes some reward into this gauge, we will calculate the reward rate. These rewards will be distributed to stakers in this gauge. So we need to calculate the reward per token. If you stake more, then you should get more rewards.

In earned() function, we will calculate the user's reward via users' weight * reward per token. We use the _getBaseWeight function to get this users' basic weight. The problem here is that basic weight's calculation is incorrect, we should use the staker's staking amount, but here we use the gauge's weight. So any staker's basic weight will be the same. The stakers who stake only 1 wei may get more rewards than those normal stakers.

function earned(address account) public view returns (uint256) {
return (getUserWeight(account) *
(getRewardPerToken() - userStates[account].rewardPerTokenPaid) / 1e18
) + userStates[account].rewards;
}
function getUserWeight(address account) public view virtual returns (uint256) {
uint256 baseWeight = _getBaseWeight(account);
return _applyBoost(account, baseWeight);
}
function getRewardPerToken() public view returns (uint256) {
if (totalSupply() == 0) {
return rewardPerTokenStored;
}
return rewardPerTokenStored + (
(lastTimeRewardApplicable() - lastUpdateTime) * rewardRate * 1e18 / totalSupply()
);
}
function _getBaseWeight(address account) internal view virtual returns (uint256) {
return IGaugeController(controller).getGaugeWeight(address(this));
}
​

Impact

The users' basic weight's calculation is incorrect.

Tools Used

Manual

Recommendations

Use the staker's staking amount to calculate the staker's basic weight.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::earned calculates rewards using getUserWeight instead of staked balances, potentially allowing users to claim rewards by gaining weight without proper reward checkpoint updates

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::earned calculates rewards using getUserWeight instead of staked balances, potentially allowing users to claim rewards by gaining weight without proper reward checkpoint updates

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.