Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

RAACGauge::setWeeklyEmission allows to set greather value than MAX_WEEKLY_EMISSION and RWAGauge::setMonthlyEmission allows to set greather value than MAX_MONTHLY_EMISSION breaking invariants

0xw3

Summary

RAACGauge::setWeeklyEmission allows to set greather value than MAX_WEEKLY_EMISSION and RWAGauge::setMonthlyEmission allows to set greather value than MAX_MONTHLY_EMISSION breaking invariants and leading to hyperinflation of tokens supply

Vulnerability Details

RAACGauge (contracts/core/governance/gauges/RAACGauge.sol) defines a maximum MAX_WEEKLY_EMISSION token emission:

uint256 public constant MAX_WEEKLY_EMISSION = 500000e18; // Maximum weekly emission

RWAGauge (contracts/core/governance/gauges/RWAGauge.sol) also defines for a max monthly emission

uint256 public constant MAX_MONTHLY_EMISSION = 2500000e18; // 2.5M tokens

However RAACGauge::setWeeklyEmission

function setWeeklyEmission(uint256 _weeklyEmission) external onlyController {
periodState.emission = _weeklyEmission;
emit EmissionUpdated(_weeklyEmission);
}

And RWAGauge::setMonthlyEmission

function setMonthlyEmission(uint256 _monthlyEmission) external onlyController {
periodState.emission = _monthlyEmission;
emit EmissionUpdated(_monthlyEmission);
}

Doesnt verify that emission arguments are less than MAX_WEEKLY_EMISSION and MAX_MONTHLY_EMISSION respectively, so it allows to bypass this invariants

The following PoC shows the described issue
Save the code in test/unit/core/governance/gauges/RAACGauge.test.js under "Period Management" section:

it("It allows setting a greater value for weekly emissions", async () => {
console.log(
"MAX_WEEKLY_EMISSION\t",
await raacGauge.MAX_WEEKLY_EMISSION()
);
const weeklyStateBefore= await raacGauge.periodState();
const emissionBefore = weeklyStateBefore.emission;
console.log("[i] emission before\t",emissionBefore);
await raacGauge.setWeeklyEmission(ethers.parseEther("999999"));
​
const weeklyStateAfter= await raacGauge.periodState();
const emissionAfter = weeklyStateAfter.emission;
console.log("[i] emission after\t",emissionAfter);
expect(emissionAfter).to.be.gt(await raacGauge.MAX_WEEKLY_EMISSION());
});

Start a node and execute the following test:

reset; npx hardhat test test/unit/core/governance/gauges/RAACGauge.test.js --network localhost

Observe max emission limits are bypassed

Impact

Lacks of checks in RAACGauge::setWeeklyEmission and RWAGauge::setMonthlyEmission allows to set greather value than MAX_WEEKLY_EMISSION and MAX_MONTHLY_EMISSION breaking invariants
leading to hyperinflation on token supply

Tools Used

Manual Review

Recommendations

Implements checks on RAACGauge::setWeeklyEmission and RWAGauge::setMonthlyEmission

function setWeeklyEmission(uint256 _weeklyEmission) external onlyController {
require(_weeklyEmission > MAX_WEEKLY_EMISSION, "Wrong _weeklyEmission value");
periodState.emission = _weeklyEmission;
emit EmissionUpdated(_weeklyEmission);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!