Core Contracts

Summary

In BaseGauge.sol , there is a flaw that fundamentally breaks the reward distribution mechanism completely. It stems from an architectural flaw in how base weights are calculated and distributed among users. Instead of calculating weights based on individual user stakes, the contract returns a global gauge weight for all users, leading to a severely disproportionate reward distribution system.

This vulnerability exists in the _getBaseWeight() function, which is central to the protocol's reward calculation mechanism. Rather than returning a user-specific weight based on their stake proportion, it returns the same global gauge weight for all users. This critical flaw allows users with minimal stakes ("minnows") to receive rewards nearly equivalent to those with massive stakes ("whales"), completely undermining the protocol's economic incentives.

My POC demonstrates that a user with just 0.0001% of the total stake (1 token vs 1M tokens) would receive up to 28% of the total rewards, representing a 280,000x multiplication of their rightful reward share. This creates a severe economic imbalance that could be exploited by malicious actors to drain protocol resources and destabilize the entire system.

Vulnerability Details

Root Cause

The vulnerability exists in the BaseGauge.sol contract's _getBaseWeight function:

This function incorrectly:

• Returns the global gauge weight instead of user-specific weight

• Ignores the user's actual stake amount

• Leads to nearly identical weights for all users regardless of their stake.

Function Flow

• User stakes tokens through stake()

2. Rewards accumulate over time

• When calculating rewards:

• getUserWeight() calls _getBaseWeight():

• . _getBaseWeight() returns same global weight for all users.

Proof of Concept

Add this code to a test file and run the code:

Proof of Concept Results

From the test output:

Under normal conditions:

• Minnow (0.0001% stake) should receive ~0.0001% of rewards

• Actually receives 28% of rewards

• Represents a 280,000x increase over expected rewards

Impact

The vulnerability has severe economic implications:

Economic Exploitation:

• Users can stake minimal amounts and receive disproportionate rewards

• Undermines the incentive structure of the protocol

• Makes large stakes economically inefficient

Protocol Sustainability:

• Unfair reward distribution would drain protocol resources

Systemic Risk:

• when exploited at scale, would destabilize the entire protocol

Tools Used

Recommendations

Modify _getBaseWeight() to consider individual stake amounts: