Core Contracts

Summary:

The BaseGauge contract's _getBaseWeight function incorrectly returns the gauge's weight instead of the user's account weight, causing reward calculations to be based on incorrect weights and leading to improper reward distributions.

Vulnerability Details:

In the BaseGauge contract:

The issue occurs because:

1. _getBaseWeight ignores its account parameter

2. Returns gauge contract's weight instead of account-specific weight

3. This incorrect weight is used in reward calculations

4. All users' rewards are calculated using the same base weight

Impact:

• Incorrect reward distribution to all users

• Users receive rewards based on gauge weight rather than individual weights

• Breaks the intended reward distribution mechanism

• Economic impact on user rewards

• Potential for unfair reward allocations

Tools Used:

Manual code review

Recommendations:

Use account parameter to get correct weight in _getBaseWeight.