Core Contracts

Summary

The BaseGauge::_getBaseWeight function incorrectly retrieves the gauge weight for the contract's address address(this) instead of the user's address account. This results in an incorrect base weight value in BaseGauge::getUserWeight, which is directly passed to the BaseGauge::_applyBoost` function and affect it. As a consequence, the boosted weight calculation for users is incorrect, potentially leading to unfair rewards or penalties.

Vulnerability Details

The vulnerability lies in the _getBaseWeight function:

Here, getGaugeWeight is called with address(this) (the contract's address) instead of the user's address account. This means that the base weight returned is the weight of the contract itself, not the user's weight. This incorrect base weight is then passed to _applyBoost in the getUserWeight function:

As a result, the boosted weight calculation is based on an incorrect base weight, leading to inaccurate results.

Impact

• The incorrect base weight affects the calculation of boosted weights, which are likely used for reward distribution.

• Users may receive incorrect rewards due to the miscalculation of their boosted weights.

• The issue is easily exploitable, as it directly affects the calculation of user weights and can be triggered by any user interacting with the protocol.

Tools Used

Manual code review

Recommendations

Update the _getBaseWeight function to retrieve the gauge weight for the user's address account instead of the contract's address address(this). The corrected function should look like this: