Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

applyboost underflows due to wrong initialization of minboost

n1kh11l

vulnerability details

In the BaseGauge constructor, minBoost is initialized to 1e18 (incorrectly, as it should be in basis points, e.g., 10000 for 1x).

This minBoost value is stored in BoostState.minBoost, which is part of the BoostState struct in the BoostCalculator library

When _applyBoost is called in BaseGauge:

function _applyBoost(address account, uint256 baseWeight) internal view virtual returns (uint256) {
if (baseWeight == 0) return 0;
IERC20 veToken = IERC20(IGaugeController(controller).veRAACToken());
uint256 veBalance = veToken.balanceOf(account);
uint256 totalVeSupply = veToken.totalSupply();
​
​
// Create BoostParameters struct from boostState
BoostCalculator.BoostParameters memory params = BoostCalculator.BoostParameters({
maxBoost: boostState.maxBoost,
minBoost: boostState.minBoost,
boostWindow: boostState.boostWindow,
totalWeight: boostState.totalWeight,
totalVotingPower: boostState.totalVotingPower,
votingPower: boostState.votingPower
});
​
​
uint256 boost = BoostCalculator.calculateBoost( ///@audit here
veBalance,
totalVeSupply,
params
);

the minboost is initalized as https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/governance/gauges/BaseGauge.sol#L142

BoostCalculator.calculateBoost uses params.minBoost directly from BaseGauge’s BoostState.

The minBoost value of 1e18 propagates into the calculation, causing an underflow when boostRange = maxBoost (25000) - minBoost (1e18).

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/libraries/governance/BoostCalculator.sol#L89-L90

uint256 boostRange = params.maxBoost - params.minBoost;
uint256 boost = params.minBoost + ((votingPowerRatio * boostRange) / 1e18);

Recommendations

initialize the minboost correctly

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

boostState.minBoost is set to 1e18

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.