Core Contracts

Summary

The _updateWeights function in the BaseGauge contract contains an if-else block where both branches execute the exact same logic. This redundancy indicates that the intended differentiated behavior for the initial period versus subsequent periods is missing.

Vulnerability Details

• Affected Function:

  function _updateWeights(uint256 newWeight) internal {

  uint256 currentTime = block.timestamp;

  uint256 duration = getPeriodDuration();

  if (weightPeriod.startTime == 0) {

  // For initial period, start from next period boundary

  uint256 nextPeriodStart = ((currentTime / duration) + 1) * duration;

  TimeWeightedAverage.createPeriod(

  weightPeriod,

  nextPeriodStart,

  duration,

  newWeight,

  WEIGHT_PRECISION

  );

  } else {

  // For subsequent periods, ensure we're creating a future period

  uint256 nextPeriodStart = ((currentTime / duration) + 1) * duration;

  TimeWeightedAverage.createPeriod(

  weightPeriod,

  nextPeriodStart,

  duration,

  newWeight,

  WEIGHT_PRECISION

  );

  }

  }

  ​

• Root Cause:

  • The if (weightPeriod.startTime == 0) condition is intended to distinguish between the initial period and later periods.

  • However, both the if and else blocks calculate nextPeriodStart in the same way and call TimeWeightedAverage.createPeriod with identical parameters.

  • This redundancy means the intended differentiated logic is not implemented.

Impact

• Misleading Implementation: The redundant branches may confuse developers, suggesting that different handling occurs for the initial period versus subsequent periods when it does not.

• Potential Miscalculations: If distinct behavior was intended for the initial period, the lack of differentiation might lead to inaccurate time-weighted average calculations and, consequently, improper reward distribution.

Tools Used

• Manual Code Review

Recommendations

1. Review Intended Behavior: Clarify whether the initial period should be handled differently. If so, implement distinct logic for each branch.

2. Eliminate Redundancy: If identical behavior is acceptable, simplify the function by removing the if-else condition and directly performing the update.