Core Contracts

Summary

The distributeRevenue function is responsible for distributing revenue between veToken holders and gauges. However, while it calculates a 20% performance share from the total amount, this share is neither assigned nor distributed within the function, leading to potential misallocation of funds.

Vulnerability Details

The function calculates the performance share as follows:

However, after this calculation, the performance share is neither stored in a variable nor transferred to any specific address or contract. Instead, only the veRAACShare (80%) is distributed to the gauges, leaving the remaining 20% unaccounted for.

Impact

The missing distribution of the performance share results in:

• Potential loss of revenue intended for a designated recipient (e.g., treasury, developers, or operational expenses).

• Accidental retention of funds within the function, leading to mismanagement of resources.

• Lack of transparency in fund allocation, which can impact trust in the system.

Tools Used

• Manual code review

Recommendations

1. Assign the performance share to a designated recipient by adding a transfer function.

2. Store the performance share in a separate variable for better tracking and accounting.