Submission Details
Severity:
Incorrect boost decimals in gauge
Summary
The users get a boost in the gauges according to their portion of the veToken holdings. The code assumes the max boost uses basis points while the minimum boost 18. This will result in an error since the maximum boost will be exceeded by the minimum boost in the following operation:
function calculateBoost(
uint256 veBalance,
uint256 totalVeSupply,
BoostParameters memory params
) internal pure returns (uint256) {
// Return base boost (1x = 10000 basis points) if no voting power
if (totalVeSupply == 0) {
return params.minBoost;
}
// Calculate voting power ratio with higher precision
uint256 votingPowerRatio = (veBalance * 1e18) / totalVeSupply;
// Calculate boost within min-max range
@> uint256 boostRange = params.maxBoost - params.minBoost;
Vulnerability Details
Impact
Users inability to claim rewards.
Tools Used
Manual review.
Recommendations
Use same decimals for both amounts.
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
boostState.minBoost is set to 1e18
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.