Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

BaseGauge Reward Distribution Race Condition

ethworker

Summary

The BaseGauge contract's reward distribution mechanism is vulnerable to a race condition where users can claim rewards multiple times before the reward state properly updates.

Vulnerability Details

In BaseGauge.sol:

/// @notice Current rate of reward distribution
uint256 public rewardRate;
​
/// @notice Last time rewards were updated
uint256 public lastUpdateTime;
​
/// @notice Accumulated rewards per token
uint256 public rewardPerTokenStored;

The issue exists because:

  1. rewardPerTokenStored updates can be manipulated through rapid claims

  2. No minimum interval enforced between reward updates

  3. Reward rate changes don't force immediate reward state updates

Impact

  • Users can claim rewards multiple times in the same block

  • Reward calculations can be manipulated through timing

  • Potential double-claiming of rewards during rate updates

Proof of Concept

contract RewardExploiter {
BaseGauge public gauge;
​
function exploit() external {
// 1. Claim rewards
gauge.claimRewards();
​
// 2. New rewards added by controller
// rewardPerTokenStored not yet updated
​
// 3. Claim again in same block
gauge.claimRewards();
}
}

Recommendation

Add claim interval enforcement and synchronize updates:

function claimRewards() external nonReentrant updateReward(msg.sender) {
require(block.timestamp >= lastClaimTime[msg.sender] + MIN_CLAIM_INTERVAL,
"Too frequent!");
​
uint256 reward = earned(msg.sender);
if (reward > 0) {
rewards[msg.sender] = 0;
lastClaimTime[msg.sender] = block.timestamp;
rewardToken.safeTransfer(msg.sender, reward);
emit RewardPaid(msg.sender, reward);
}
}
​
modifier updateReward(address account) {
rewardPerTokenStored = rewardPerToken();
lastUpdateTime = lastTimeRewardApplicable();
if (account != address(0)) {
rewards[account] = earned(account);
userRewardPerTokenPaid[account] = rewardPerTokenStored;
}
_;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.