Core Contracts

Summary

The BaseGauge::lastUpdateTime variable is not initialized in the constructor, leading to incorrect reward calculations during the first execution of updateReward(). This results in the first user claiming all accumulated rewards for an entire period (e.g., 7 days), causing a financial loss to the protocol.

Vulnerability Details

When updateReward() is called for the first time, the execution flow proceeds as follows:

Looking at the lastTimeRewardApplicable() function:

• The periodFinish() function determines when the reward period ends:

• However, since lastUpdateTime is initially 0, periodFinish() returns:

  0 + 7 days = 7 days

So the value of lastUpdateTime will set to wrong value which will be 7 days, as we can see in this function,

Example Scenario:

1. A user calls updateReward() for the first time.

2. The protocol assumes 7 days of rewards have accrued instead of calculating from an actual lastUpdateTime.

3. lastUpdateTime set's to the wrong value which is 7 days

Impact

• Wrong calculation of reward tokens.

• Very less amount of tokens will get distributed.

Tools Used

• Manual Code Review

Recommendations

1. Initialize lastUpdateTime in the constructor:

   constructor() {

   lastUpdateTime = block.timestamp;

   }