Core Contracts

Summary

The GaugeController.sol contract contains unbounded loops, allowing attackers to spam transactions and permanently freeze gauge rewards.

Vulnerability Details

1. Unbounded Loop in distributeRevenue() Function

   GaugeController.sol (Vulnerable Code)

   for (uint256 i = 0; i < _gaugeList.length; i++) {

   distributeToGauge(_gaugeList[i], amount);

   }

• If _gaugeList is too large, the transaction will exceed the gas limit and fail.

• This permanently breaks revenue distribution.

Impact

• Funds Locked in Treasury – Rewards cannot be distributed.

• Governance Functions Halted – Voting weights and emissions break.

Tools Used

• Manual Review – Identified unbounded loop.

Recommendations

• Use Batch Processing Instead of Single Loops

• Limit _gaugeList.length to a Reasonable Size