Core Contracts

Summary

The BaseGauge contract’s emergency pause stops users from staking, withdrawing, or claiming rewards, but lets the controller keep updating periods and adding rewards. The protocol doc says a pause should stop all operations, so this mismatch will keep piling up unexpected rewards even while paused.

Vulnerability Details

User actions like staking or claiming rewards stop because they use a rule called whenNotPaused. But controller actions, like updating periods or adding rewards don’t have this rule and can still happen.

When not paused, the two functions can call notifyRewardAmount to add more rewards or updatePeriod to move time periods forward. When notifyRewardAmount runs, it updates the rewardRate and lastUpdateTime. This makes rewards build up here:

The protocol doc says an emergency pause “stops all operations,” meaning everything should freeze, user actions and controller actions. But right now, the controller can keep going.

Impact

1. Rewards keep growing during a pause because the controller can add more. When unpaused, users might get a big payout they didn’t expect, or the reward pool could run out if too much builds up.

2. If the controller adds rewards without enough tokens in the contract, claims will stop working when unpaused because of this check

Tools Used

Manual Review

Recommendations

Add whenNotPaused to controller functions so they stop during a pause. This makes the pause stop everything, no reward updates or period changes until unpaused.