Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`BaseGauge::_applyBoost` function doesn't work as intended

kirobrejka

Summary

This is due to the returned value from the function

Vulnerability Details

The BaseGauge::_applyBoost function aims to apply boost to the baseWeight input. The problem here is that the baseWeight * boost is divided by 1e18 instead of being divided by 100% denominated in basis points (10_000). By dividing with 1e18 the _applyBoost function doesn't actually apply boost to the amount since it will return a number denominated in basis points, which will lead to users having extremely small rewards. This can be see here:

function _applyBoost(
address account,
uint256 baseWeight
) internal view virtual returns (uint256) {
if (baseWeight == 0) return 0;
​
IERC20 veToken = IERC20(IGaugeController(controller).veRAACToken());
uint256 veBalance = veToken.balanceOf(account);
uint256 totalVeSupply = veToken.totalSupply();
​
// Create BoostParameters struct from boostState
BoostCalculator.BoostParameters memory params = BoostCalculator
.BoostParameters({
maxBoost: boostState.maxBoost,
minBoost: boostState.minBoost,
boostWindow: boostState.boostWindow,
totalWeight: boostState.totalWeight,
totalVotingPower: boostState.totalVotingPower,
votingPower: boostState.votingPower
});
​
uint256 boost = BoostCalculator.calculateBoost(
veBalance,
totalVeSupply,
params
);
return (baseWeight * boost) / 1e18;
}
​

To apply boost to the baseWeight the division should be by 10_000 not by 1e18. By dividing with 1e18 the returned amount is in basis points

Impact

Users will receive extremely low rewards because of this

Tools Used

Manual Review

Recommendations

Divide by 10_000 instead of 1e18

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge reward calculations divide by 1e18 despite using 1e4 precision weights, causing all user weights to round down to zero and preventing reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.