Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Validation in BaseGauge's setBoostParameters Function Could Break Boost Calculations

0xterrah

Relevant GitHub Links

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/gauges/BaseGauge.sol#L540

Summary

The setBoostParameters() function in BaseGauge.sol lacks validation checks for boost parameters, potentially allowing invalid values that could break boost calculations.

Vulnerability Details

function setBoostParameters(
uint256 _maxBoost,
uint256 _minBoost,
uint256 _boostWindow
) external onlyController {
boostState.maxBoost = _maxBoost; // No validation
boostState.minBoost = _minBoost;
boostState.boostWindow = _boostWindow;
}
``` fs
​
These parameters are used in boost calculations:
```solidity
uint256 boostRange = params.maxBoost - params.minBoost; // Could underflow
uint256 boost = params.minBoost + ((votingPowerRatio * boostRange) / 1e18);

Impact

If controller sets invalid parameters:

  • maxBoost < minBoost → underflow in boost calculations

  • boostWindow = 0 → division by zero in time-weighted calculations

  • maxBoost too high → potential overflow in reward calculations

Tools Used

Manual Review

Recommendations

Add parameter validation:

function setBoostParameters(
uint256 _maxBoost,
uint256 _minBoost,
uint256 _boostWindow
) external onlyController {
require(_maxBoost > _minBoost, "Invalid boost range");
require(_boostWindow > 0, "Invalid window");
require(_maxBoost <= 25000, "Exceeds max boost cap"); // 2.5x based on protocol limits
boostState.maxBoost = _maxBoost;
boostState.minBoost = _minBoost;
boostState.boostWindow = _boostWindow;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!