The `_getBaseWeight(address account)` in the `BaseGauge.sol` function is intended to retrieve a user’s base weight, but it incorrectly calls `getGaugeWeight(address(this))` instead of using the provided `account` parameter. This error results in the gauge weight of the contract being used for every user, which then affects the boosted weight calculation in `_applyBoost()`, leading to an inaccurate overall user weight.
According to the intended design, `_getBaseWeight(address account)` should query the gauge controller with the user's address to obtain the correct base weight. However, the implementation mistakenly passes `address(this)` to `getGaugeWeight`, as shown below:
``` solidity
function _getBaseWeight(address account) internal view virtual returns (uint256) {
// The function _getBaseWeight(address account) is supposed to get the base weight for a user (account) according to the documentation,
// However, instead of using account, it calls getGaugeWeight(address(this)), which retrieves the gauge weight for the contract itself, not the user.
return IGaugeController(controller).getGaugeWeight(address(this));
}
```
As a result, when `getUserWeight(address account)` calls `_applyBoost(account, baseWeight)`, it operates on an incorrect base weight. The boost function then compounds this error, causing the final user weight to be miscalculated.
### Proof of Concept
Consider a scenario with two users:
User A: Has significant participation and should have a high gauge weight.
User B: Has minimal participation and should have a low gauge weight.
Under proper implementation, `_getBaseWeight(UserA)` and `_getBaseWeight(UserB)` should return distinct values reflective of their individual contributions. However, since the function calls `getGaugeWeight(address(this))`, both users receive the same base weight—the gauge weight of the contract. This identical base weight is then fed into `_applyBoost()`, resulting in both users receiving an identical, incorrect boosted weight, regardless of their actual stake.
Inaccurate User Weight: The weight used to determine rewards, fees, or participation rights is derived from a base weight that does not reflect the individual user, leading to unfair or incorrect outcomes.
Misallocation of Rewards: Since user weight often directly influences reward distribution, users may receive rewards that are not proportional to their actual participation or stake.
Systemic Trust Issues: Continuous miscalculation of user weight can erode trust in the protocol’s governance and economic models.
Correct the Parameter: Refactor `_getBaseWeight()` to use the account parameter, as follows:
```solidity
function _getBaseWeight(address account) internal view virtual returns (uint256) {
return IGaugeController(controller).getGaugeWeight(account);
}
```
Review Downstream Logic: Verify that the `_applyBoost()` function properly applies boost factors when provided with an accurate base weight.
Implement Unit Tests: Develop comprehensive tests to ensure that different user addresses yield different base weights and that the boosted weight reflects true user participation.
Update Documentation: Ensure that the function implementation aligns with the documented behavior and intended protocol design.