Core Contracts

Summary

The _getBaseWeight function claims to return the base weight for an account but instead retrieves the base weight for the contract itself (address(this)).

Vulnerability Details

The function is defined as:

Here, the function takes an account parameter but does not use it. Instead, it calls getGaugeWeight with address(this), which retrieves the base weight for the contract rather than for the specified account.

Impact

Any logic that depends on _getBaseWeight(account) for account-specific calculations will be incorrect, potentially leading to miscalculations in staking rewards, voting power, or other weight-based operations.

Tools Used

• Manual Code Review

Recommendations

• If the intention is to fetch the base weight for a specific account, the function should pass account to the getGaugeWeight function, assuming the external contract supports per-account weight retrieval.

• If the function is only meant to retrieve the gauge weight for the contract itself, the misleading account parameter should be removed to avoid confusion.