Summary

The periodFinish function in the BaseGuage.sol is supposed to help the reward calculation by returning the time at which the period will end. But it is incorrect and keeps on adding the periodDuration to the lastUpdateTime variable. This is wrong.

Vulnerability Details

The lastUpdateTime is not just the startTime of the reward distribution period, but it is updated everytime someone stakes/withdraws etc.

This causes the reward Distribution to be messed up and give incorrect values. Also the period never ends.

Impact

Never ending reward period

Tools Used

manual review

Recommendations

Update the periodFinish to

return periodState.periodStartTime + getPeriodDuration();

Note: also in the notifyRewarAmount you may have to update the periodState.periodStartTime = block.Timestamp