Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Slippage Protection in Weight Updates Despite Documentation Claims (Potential Weight Manipulation)

skidd0016

Link to Affected Code:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/gauges/BaseGauge.sol#L185-L210

Description:\

The BaseGauge documentation explicitly states Slippage protection on weight updates as a feature, however, no implementation of this protection exists in the codebase. The weight update functions in both BaseGauge and GaugeController allow arbitrary weight changes without any bounds checking or protection against sudden large changes.

Impact:

The lack of slippage protection in weight updates could lead to Sudden large weight changes affecting reward distribution

Proof of Concept:

​
// 1. Contract defines slippage limit
​
uint256 public constant MAX_SLIPPAGE = 100; // 1%
​
// 2. TimeWeightedAverage.createPeriod only checks for zero
​
function createPeriod(
​
Period storage self,
​
uint256 startTime,
​
uint256 duration,
​
uint256 initialValue,
​
uint256 weight
​
) internal {
​
if (weight == 0) revert ZeroWeight();
​
// No check against previous weight
​
}
​
// 3. _updateWeights allows arbitrary changes
​
function _updateWeights(uint256 newWeight) internal {
​
// No comparison with weightPeriod.weight
​
TimeWeightedAverage.createPeriod(
​
weightPeriod,
​
nextPeriodStart,
​
duration,
​
newWeight, // Could be any value
​
WEIGHT_PRECISION
​
);
​
}
​

Recommended Mitigation:

Add slippage protection using the defined constant:

​
function _updateWeights(uint256 newWeight) internal {
​
uint256 oldWeight = weightPeriod.weight;
​
​
// Skip check for initial period
​
if (oldWeight != 0) {
​
uint256 maxChange = (oldWeight * MAX_SLIPPAGE) / 10000; // 1% max change
require(
​
newWeight <= oldWeight + maxChange &&
​
newWeight >= oldWeight - maxChange,
​
"Weight change exceeds slippage"
​
);
​
}
// Rest of the function...
​
TimeWeightedAverage.createPeriod(...);
​
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.