Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`BaseGauge::updatePeriod` function can never be called, which will eventually lead to full DoS of the reward system of the gauge

kirobrejka

Summary

This is due to the fact that the BaseGauge::updatePeriod function is supposed to be called by GaugeController, but the GaugeController never calls it

Vulnerability Details

The RAACGauge has the maximum of 500000e18 (500k) weekly emissions, which is set in the BaseGauge constructor. Without calling the updatePeriod function, the distributed variable will never go back to 0, which is the reason that will get the gauge DoSed eventually. When the GaugeController calls the BaseGauge::notifyRewardAmount function, it increments the distributed variable as can be seen here:

function notifyRewardAmount(
uint256 amount
) external override onlyController updateReward(address(0)) {
if (amount > periodState.emission) revert RewardCapExceeded();
​
rewardRate = notifyReward(
periodState,
amount,
periodState.emission,
getPeriodDuration()
);
@> periodState.distributed += amount;
​
uint256 balance = rewardToken.balanceOf(address(this));
if (rewardRate * getPeriodDuration() > balance) {
revert InsufficientRewardBalance();
}
​
lastUpdateTime = block.timestamp;
emit RewardNotified(amount);
}

This shows that if the updatePeriod function is never called by the GaugeController, the gauge will eventually get DoSed. The following line of code confirms it as well:

function notifyReward(
PeriodState storage state,
uint256 amount,
uint256 maxEmission,
uint256 periodDuration
) internal view returns (uint256) {
if (amount > maxEmission) revert RewardCapExceeded();
@> if (amount + state.distributed > state.emission) {
revert RewardCapExceeded();
}
​
uint256 rewardRate = amount / periodDuration;
if (rewardRate == 0) revert ZeroRewardRate();
​
return rewardRate;
}
​

Impact

All of the gauges will eventually get DoSed because the updatePeriod function is never called in GaugeController

Tools Used

Manual Review

Recommendations

At some point call the updatePeriod function or just make the contract owner responsible for this action

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::updatePeriod doesn't call the gauge's updatePeriod function, preventing periodState.distributed from resetting and eventually causing distributeRewards to permanently fail

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::updatePeriod doesn't call the gauge's updatePeriod function, preventing periodState.distributed from resetting and eventually causing distributeRewards to permanently fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.