Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Performance Share is lost in GaugeController

waydou

Summary

In the GaugeController contract's distributeRevenue function, 20% of the revenue is allocated as performance share but is never distributed or tracked, effectively making these tokens stuck or lost.

Vulnerability Details

In distributeRevenue:

function distributeRevenue(
GaugeType gaugeType,
uint256 amount
) external onlyRole(EMERGENCY_ADMIN) whenNotPaused {
if (amount == 0) revert InvalidAmount();
uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
uint256 performanceShare = amount * 20 / 100; // 20% performance fee
// we're not tracking the performance fees by gauge
revenueShares[gaugeType] += veRAACShare;
_distributeToGauges(gaugeType, veRAACShare);
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);
}

The issues are:

  1. performanceShare is calculated (20% of amount) but never used

  2. While performanceFees mapping exists in storage, it's never updated

  3. The tokens allocated for performance shares are not transferred anywhere

  4. Only the veRAACShare (80%) is actually distributed via _distributeToGauges

Impact

Funds are stuck in the contract and Gauges don't receive their intended performance fees.

Tools Used

Manual Review

Recommendations

Create a function _distributePerformanceFees

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.