No way to update the period in the BaseGuage.sol causing rewards DOS
Summary
It is expected in a guage that in 1 period only certain amount of reward can be added. Thus, if the period cant be updated to the next one, the rewards added will also have to stop after reaching the limit. The function to update the period is not callable by the guageController. And thus rewards are capped for a guage.
Vulnerability Details
UpdatePeriod() function has the onlyController modifier which limits its msg.sender to the guageController.sol. But there is no call to the updatePeriod function from the guageController. Thus this function cant be called.
Impact
Rewards are capped unintentionally in the guages.
Tools Used
manual review
Recommendations
Add a method to call the updatePeriod in the guageController.sol
Lead Judging Commences
`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller
`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller
Appeal created
GaugeController::updatePeriod doesn't call the gauge's updatePeriod function, preventing periodState.distributed from resetting and eventually causing distributeRewards to permanently fail
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.