Core Contracts

Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Submission Details
Severity: high
Valid

Incorrect Parameter Usage in _getBaseWeight() Leads to Inaccurate Boost Calculation

Summary

The `_getBaseWeight(address account)` in the `BaseGauge.sol` function is intended to retrieve a user’s base weight, but it incorrectly calls `getGaugeWeight(address(this))` instead of using the provided `account` parameter. This error results in the gauge weight of the contract being used for every user, which then affects the boosted weight calculation in `_applyBoost()`, leading to an inaccurate overall user weight.

Vulnerability Details

According to the intended design, `_getBaseWeight(address account)` should query the gauge controller with the user's address to obtain the correct base weight. However, the implementation mistakenly passes `address(this)` to `getGaugeWeight`, as shown below:
``` solidity
function _getBaseWeight(address account) internal view virtual returns (uint256) {
// The function _getBaseWeight(address account) is supposed to get the base weight for a user (account) according to the documentation,
// However, instead of using account, it calls getGaugeWeight(address(this)), which retrieves the gauge weight for the contract itself, not the user.
return IGaugeController(controller).getGaugeWeight(address(this));
}
```
As a result, when `getUserWeight(address account)` calls `_applyBoost(account, baseWeight)`, it operates on an incorrect base weight. The boost function then compounds this error, causing the final user weight to be miscalculated.
### Proof of Concept
Consider a scenario with two users:
User A: Has significant participation and should have a high gauge weight.
User B: Has minimal participation and should have a low gauge weight.
Under proper implementation, `_getBaseWeight(UserA)` and `_getBaseWeight(UserB)` should return distinct values reflective of their individual contributions. However, since the function calls `getGaugeWeight(address(this))`, both users receive the same base weight—the gauge weight of the contract. This identical base weight is then fed into `_applyBoost()`, resulting in both users receiving an identical, incorrect boosted weight, regardless of their actual stake.

Impact

Inaccurate User Weight: The weight used to determine rewards, fees, or participation rights is derived from a base weight that does not reflect the individual user, leading to unfair or incorrect outcomes.
Misallocation of Rewards: Since user weight often directly influences reward distribution, users may receive rewards that are not proportional to their actual participation or stake.
Systemic Trust Issues: Continuous miscalculation of user weight can erode trust in the protocol’s governance and economic models.

Tools Used

Manual review and foundry

Recommendations

Correct the Parameter: Refactor `_getBaseWeight()` to use the account parameter, as follows:
```solidity
function _getBaseWeight(address account) internal view virtual returns (uint256) {
return IGaugeController(controller).getGaugeWeight(account);
}
```
Review Downstream Logic: Verify that the `_applyBoost()` function properly applies boost factors when provided with an accurate base weight.
Implement Unit Tests: Develop comprehensive tests to ensure that different user addresses yield different base weights and that the boosted weight reflects true user participation.
Update Documentation: Ensure that the function implementation aligns with the documented behavior and intended protocol design.
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge._getBaseWeight ignores account parameter and returns gauge's total weight, allowing users to claim rewards from gauges they never voted for or staked in

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge._getBaseWeight ignores account parameter and returns gauge's total weight, allowing users to claim rewards from gauges they never voted for or staked in

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!