Submission Details
Severity:
The boost parmater are wrong in the constructor of the gauges
Summary
The minBoost parameter is higher than the maxBoost making the applied boost always eqal to 1e18.
Vulnerability Details
In the constructor of the BaseGauge set the maxBoost and minBoost as follow :
boostState.maxBoost = 25000; // 2.5x
boostState.minBoost = 1e18;
The minBoost is higher than the maxBoost making then the boost applied making the lines of max boost unreacheable in the boostCalculator L-96 :
if (boost < params.minBoost) {
return params.minBoost;
}
if (boost > params.maxBoost) {
return params.maxBoost;
}
Moreover the boost applied will be creater than expected.
Impact
The boost applied will make no sense.
Tools Used
Manual review
Recommendations
Change the constructor to have the min boost lesser than max boost.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
boostState.minBoost is set to 1e18
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.