Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

GaugeController::setTypeWeight allows sum of gauge weights percentages be more than 100% leading to reward distribution inconsistencies

0xw3

Summary

GaugeController::setTypeWeight allows sum of gauge weights percentages be more than 100% leading to reward distribution inconsistencies

Vulnerability Details

GaugeController::setTypeWeight checks that weight for a GaugeType is not greather than 100% (MAX_TYPE_WEIGHT = 10000):

function setTypeWeight(
GaugeType gaugeType,
uint256 weight
) external onlyRole(GAUGE_ADMIN) {
@> if (weight > MAX_TYPE_WEIGHT) revert InvalidWeight();

However, it allows sum of gauge weights percentages be more than 100% leading to reward distribution inconsistencies

The following PoC shows the issue described below.
RWA type is set to 100% and RAAC type is set to 99%
GaugeController allows setting sum of weights more than 100%
Save the following code in test/unit/core/governance/gauges/GaugeController.test.js under "Weight Management" section:

it("Allows to set sum of weights more than 100%", async () => {
await gaugeController.connect(gaugeAdmin).setTypeWeight(
0, // RWA type
10000 // Initial weight
);
await gaugeController.connect(gaugeAdmin).setTypeWeight(
1, // RAAC type
9999 // Initial weight
);
console.log("RWA weight ",await gaugeController.getTypeWeight(0));
console.log("RAAC weight ",await gaugeController.getTypeWeight(1));
});

Start node and Execute test:

reset; npx hardhat test test/unit/core/governance/gauges/GaugeController.test.js --network localhost

Impact

Setting sum of gauge weights percentages be more than 100% leads to reward distribution inconsistencies

Tools Used

Manual Review

Recommendations

Implement a conditional to check that sum of weights percentages is not greather than 100%

function setTypeWeight(
GaugeType gaugeType,
uint256 weight
) external onlyRole(GAUGE_ADMIN) {
if (weight > MAX_TYPE_WEIGHT) revert InvalidWeight();
uint256 oldWeight = typeWeights[gaugeType];
typeWeights[gaugeType] = weight;
@> if(typeWeights[GaugeType.RWA] + typeWeights[GaugeType.RAAC] - oldWeight > MAX_TYPE_WEIGHT ) revert InvalidWeight();
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!