Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Reward Token Transfer in NotifyRewardAmount

waydou

Summary

The notifyRewardAmount function in BaseGauge contract updates reward accounting and distribution state without requiring actual token transfer into the contract.

Vulnerability Details

function notifyRewardAmount(uint256 amount) external override onlyController updateReward(address(0)) {
if (amount > periodState.emission) revert RewardCapExceeded();
rewardRate = notifyReward(periodState, amount, periodState.emission, getPeriodDuration());
periodState.distributed += amount; // @audit Increasing without actual transfer
uint256 balance = rewardToken.balanceOf(address(this));
if (rewardRate * getPeriodDuration() > balance) {
revert InsufficientRewardBalance();
}
lastUpdateTime = block.timestamp;
emit RewardNotified(amount);
}

The function:

Updates periodState.distributed
Updates rewardRate
But never transfers tokens to the contract
I should note that this function have an onlyController modifier but in the GaugeController we don't send tokens when we use this function.

Impact

Contract state becomes desynchronized from actual token balance and Users may be unable to claim rewards due to insufficient contract balance

Tools Used

Manual Review

Recommendations

Add token transfer

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController notifies gauges of rewards without transferring tokens in both distributeRewards and _distributeToGauges functions, breaking reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.