Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect minBoost initialization in BaseGauge causes boost calculation failures and DoS

0xwhyzee

Description

The core issue stems from BaseGauge.sol incorrectly initializing minBoost with 1e18 precision instead of basis points (10000 = 1x). This invalid parameter configuration propagates to BoostCalculator::calculateBoost, resulting in arithmetic overflow, causing DoS of functions that depend on it.

Proof of Concept

Test Case Showing Valid vs Invalid Initialization:

// Add to BoostCalculator.test.js
it("works correctly with proper basis points initialization", async () => {
// Valid parameters (10000 = 1x)
await boostCalculator.setBoostParameters(
25000n, // maxBoost (2.5x)
10000n, // CORRECT minBoost (1x)
7n * 24n * 3600n,
ethers.parseEther("1"),
ethers.parseEther("10000"),
ethers.parseEther("10000")
);
​
const [validBoost] = await boostCalculator.calculateTimeWeightedBoostView(
ethers.parseEther("1000"), // 10% ownership
ethers.parseEther("10000"),
ethers.parseEther("100")
);
expect(validBoost).to.equal(11500n); // 1.15x boost as expected
});
​
it("fails with BaseGauge-style initialization", async () => {
// Replicate BaseGauge's incorrect initialization
await boostCalculator.setBoostParameters(
25000n,
ethers.parseEther("1"), // WRONG initialization from BaseGauge (1e18)
7n * 24n * 3600n,
ethers.parseEther("1"),
ethers.parseEther("10000"),
ethers.parseEther("10000")
);
​
await expect(
boostCalculator.calculateTimeWeightedBoostView(
ethers.parseEther("1000"), // 10% ownership
ethers.parseEther("10000"),
ethers.parseEther("100")
)
).to.be.revertedWithPanic(0x11); // Arithmetic underflow
});

Key Differentiator:

  • First test shows correct behavior with proper 10000 (1x) initialization

  • Second test replicates BaseGauge's flawed initialization pattern, demonstrating failure

Impact

High Severity - The root cause is in BaseGauge.sol's initialization logic.

This affects all functions that directly/indirectly depends on the BoostCalculator::calculateBoost logic, causing DoS. The affected functions are:

  • _applyBoost

  • getUserWeight

  • earned

  • _updateReward

Recommendation

// contracts/core/governance/gauges/BaseGauge.sol
function initializeBoostState() external {
- boostState.minBoost = 1e18; // WRONG
+ boostState.minBoost = 10000; // CORRECT basis points (1x)
​
function setBoostParameters() external {
+ require(_minBoost <= 10000, "Min boost exceeds 1x");
+ require(_maxBoost > _minBoost, "Invalid boost range");
boostState.minBoost = _minBoost;
}

This ensures:

  1. Initialization uses correct basis points format

  2. Parameter validation prevents invalid configurations

  3. BoostCalculator remains unchanged as it's not the source of the bug

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

boostState.minBoost is set to 1e18

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!