Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect initialization of the boostState.minBoost in the BaseGuage.sol contract

anonymousjoe

Summary

In the BaseGuage.sol the maxBoost is initialized as 25000 and the minBoost is initialized as 1e18. This is wrong and leads to applyBoost function always reverting.

Vulnerability Details

constructor(
address _rewardToken,
address _stakingToken,
address _controller,
uint256 _maxEmission,
uint256 _periodDuration
) {
rewardToken = IERC20(_rewardToken);
stakingToken = IERC20(_stakingToken);
controller = _controller;
// Initialize roles
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(CONTROLLER_ROLE, _controller);
// Initialize boost parameters
boostState.maxBoost = 25000; // 2.5x
// @audit2 should be 10000 not 1e18 (apply boost will always revert)
boostState.minBoost = 1e18;

When the applyBoost function is called (during the reward calculation of the users) it calls the calculateBoost in the BoostCalculator.sol. Here the following expression is calculated:

uint256 boostRange = params.maxBoost - params.minBoost;

Because of the incorrect initialization, this will always revert and thus no user can stake/withdraw or even rewards cant be added into the BaseGuage.sol

Impact

all guages will become unusable

Tools Used

manual review

Recommendations

update minBoost to 1e4 instead of 1e18

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

boostState.minBoost is set to 1e18

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.