Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Performance fee share never gets added/collected or distributed in GaugeController.sol::distributeRevenue()

tamer

Summary

The distributeRevenue function job is to distribute revenue between veRAAC holders(80%) and performance fees(20%). But only veRACC share is correctly added to it's mapping, while performance share is not. This means that the intended 20% permormance fee is lost and remains untracked.

Vulnerability Details

/**
* @notice Distributes revenue between veToken holders and gauges
* @dev Only callable by emergency admin
* @param gaugeType Type of gauge for distribution
* @param amount Amount to distribute
*/
function distributeRevenue(
GaugeType gaugeType,
uint256 amount
) external onlyRole(EMERGENCY_ADMIN) whenNotPaused {
if (amount == 0) revert InvalidAmount();
uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
uint256 performanceShare = amount * 20 / 100; // 20% performance fee
revenueShares[gaugeType] += veRAACShare;
// @audit performanceShare has not been added to the performanceFees mapping
_distributeToGauges(gaugeType, veRAACShare);
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);
}

The expected behaviour would be to store performanceShare to it's mapping so it can be tracked/distributed.
The calculated performanceShare never gets stored or used anywhere.

Impact

The 20% performance fee is never allocated or stored or distributed.
The emitted event is misleading that everything is fine.

Tools Used

Manual

Recommendations

Since performanceFees mapping requires an address in order to account the fees, the function must be refactored to meet the requirements for performanceFees update.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

inallhonesty Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.