Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Entire reward system in BaseGuage is flawed

anonymousjoe

Summary

The entire reward system in the BaseGuage is flawed.

Vulnerability Details

function getRewardPerToken() public view returns (uint256) {
if (totalSupply() == 0) {
return rewardPerTokenStored;
}
​
return rewardPerTokenStored + (
(lastTimeRewardApplicable() - lastUpdateTime) * rewardRate * 1e18 / totalSupply()
);
}

It is possible for the rewards > totalRewards available. This itself shows that the reward system is flawed.

Note that this is possible because when calculating the rewards of a user, the boost value is also taken into account, which means that the rewards the user can calim can be greater than the totalRewards.

return (getUserWeight(account) *
(getRewardPerToken() - userStates[account].rewardPerTokenPaid) / 1e18
) + userStates[account].rewards;


The underlying cause is that the totalSupplyused in the rewardPerTokenStored calculation doesnt take the boost into account.

Impact
Flawed reward system

Tools Used

manual review

Recommendations

consider using the boost in the rewardPerTokenStored in someway and limiting the values such that the rewards are distributed fairly.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::earned calculates rewards using getUserWeight instead of staked balances, potentially allowing users to claim rewards by gaining weight without proper reward checkpoint updates

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::earned calculates rewards using getUserWeight instead of staked balances, potentially allowing users to claim rewards by gaining weight without proper reward checkpoint updates

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!