Submission Details
Severity:
Incorrect Boost Parameter Initialization Breaks Reward Claims
Summary
In BaseGauge.sol, boost parameters are initialized with minBoost (1e18) greater than maxBoost (25000), causing all reward claims to fail due to the InvalidBoostBounds check in BoostCalculator.
Vulnerability Details
In BaseGauge.sol constructor, we initial these values
/// @notice Maximum boost multiplier (2.5x)
uint256 public constant MAX_BOOST = 25000; // 2.5x maximum boost
/// @notice Minimum boost multiplier (1.0x)
uint256 public constant MIN_BOOST = 10000; // 1.0x minimum boost
The call path of a user that will fail:
getReward() -> earned() -> getUserWeight() -> _applyBoost() -> calculateBoost()
and in calculateBoost we have this
uint256 boostRange = params.maxBoost - params.minBoost; // Will underflow
// 25000 - 1e18 underflows
Impact
All boost calculations will revert due to underflow
Users cannot claim rewards
Tools Used
Manual review
Recommendations
Correct the boost parameter
boostState.maxBoost = 25000; // 2.5x
boostState.minBoost = 10000; // 1.0x
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
boostState.minBoost is set to 1e18
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.