Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect update of `state.rewardPerTokenPaid` in `BaseGauge.sol::_updateReward()`.

orangesantra

Summary

Contract - BaseGauge.sol

The _updateReward() function is as follow -

function _updateReward(address account) internal {
rewardPerTokenStored = getRewardPerToken();
lastUpdateTime = lastTimeRewardApplicable();
​
if (account != address(0)) {
UserState storage state = userStates[account];
state.rewards = earned(account);
@-> state.rewardPerTokenPaid = rewardPerTokenStored;
state.lastUpdateTime = block.timestamp;
emit RewardUpdated(account, state.rewards);
}
}

The rewardPerTokenStored deals with accumulated reward per Token, collectively for all users. It doesn't deals with single user.

Vulnerability Details

  1. Currently it's state.rewardPerTokenPaid = rewardPerTokenStored, which is wrong.

  2. Because state.rewardPerTokenPaid purpose if to track the amount or reward per token paid to a user, not all user.

  3. Means state.rewardPerTokenPaid is wrongly being updated, with a state variable that's used for collective all user.

Impact

  1. Incorrect updation of userStates[account] .

  2. userStates[account] is being used in earned() function.

function earned(address account) public view returns (uint256) {
return (getUserWeight(account) *
(getRewardPerToken() - userStates[account].rewardPerTokenPaid) / 1e18
) + userStates[account].rewards;
}

  1. earned() function is being used to calculate reward earned by user.

  2. Hence, wrong amount will be calculated and transferred to user.

  3. Loss to fund and to protocol and user.

Tools Used

Manual

Recommendations

Change the current architecture if function, by using share based model. calculate user's share and multiply by rewardPerTokenStored then use that value to update state.rewardPerTokenPaid.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.