Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Performance Share is lost in GaugeController

waydou

Summary

In the GaugeController contract's distributeRevenue function, 20% of the revenue is allocated as performance share but is never distributed or tracked, effectively making these tokens stuck or lost.

Vulnerability Details

In distributeRevenue:

function distributeRevenue(
GaugeType gaugeType,
uint256 amount
) external onlyRole(EMERGENCY_ADMIN) whenNotPaused {
if (amount == 0) revert InvalidAmount();
uint256 veRAACShare = amount * 80 / 100; // 80% to veRAAC holders
uint256 performanceShare = amount * 20 / 100; // 20% performance fee
// we're not tracking the performance fees by gauge
revenueShares[gaugeType] += veRAACShare;
_distributeToGauges(gaugeType, veRAACShare);
emit RevenueDistributed(gaugeType, amount, veRAACShare, performanceShare);
}

The issues are:

  1. performanceShare is calculated (20% of amount) but never used

  2. While performanceFees mapping exists in storage, it's never updated

  3. The tokens allocated for performance shares are not transferred anywhere

  4. Only the veRAACShare (80%) is actually distributed via _distributeToGauges

Impact

Funds are stuck in the contract and Gauges don't receive their intended performance fees.

Tools Used

Manual Review

Recommendations

Create a function _distributePerformanceFees

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController.distributeRevenue calculates 20% performance fee but never transfers or allocates it to any recipient, causing loss of funds

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!