Core Contracts

Summary

The BaseGauge constructor initializes maxBoost and minBoost with inconsistent scaling, which could lead to miscalculations when applying boost factors. The maxBoost value appears to be based on a precision of 1e4 (10,000), while minBoost is set using 1e18 (ERC20 decimal precision). This inconsistency can cause incorrect calculations and unexpected behavior in boost-related functions.

Vulnerability Details

• Affected Code:

  boostState.maxBoost = 25000; // 2.5x

  boostState.minBoost = 1e18;

  ​

• Issue:

  • maxBoost = 25000 follows a 1e4 precision system, meaning 25000 / 10000 = 2.5x, aligning with VOTE_PRECISION = 10000 elsewhere in the contract.

  • minBoost = 1e18 suggests a 1x boost but is expressed using 1e18 precision, which is commonly used for ERC20 token balances, not boost multipliers.

  • This mismatch in precision units could lead to incorrect scaling when boost calculations are performed, potentially misrepresenting user rewards and incentives.

Impact

• Incorrect boost application could lead to miscalculated rewards.

• Users might receive either lower or higher rewards than intended.

• Potential difficulty in debugging and maintaining boost-related logic due to inconsistent precision standards.

Tools Used

• Manual code review

Recommendations

• Ensure consistent precision across all boost values.