Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`BaseGauge::distributionCap` State Variable Can Be Set, But Is Never Enforced.

0xnforcer

Summary

The BaseGauge contract contains an unused distributionCap state variable and associated setter function that appear to be deprecated in favor of the emission system, creating unnecessary gas costs and potential confusion.

Vulnerability Details

The contract includes:

  1. A state variable: uint256 public distributionCap

  2. A setter function: setDistributionCap(uint256 newCap)

  3. Associated events for cap updates

However, this functionality is never used in any validation logic. Meanwhile, a newer emission system in PeriodState handles reward distribution limits, suggesting that distributionCap is legacy code that was replaced but not removed.

Code snippet:

/// @notice Cap on reward distribution amount
uint256 public distributionCap;
​
/**
* @notice Sets cap on reward distribution
* @param newCap New distribution cap value
*/
function setDistributionCap(uint256 newCap) external {
if (!hasRole(FEE_ADMIN, msg.sender)) revert UnauthorizedCaller();
distributionCap = newCap;
emit DistributionCapUpdated(newCap);
}
​

Impact

  • Increased gas costs due to unnecessary storage variable and function

  • Potential confusion for developers and auditors

  • Misleading contract interface suggesting functionality that isn't actually used

  • Risk of future developers incorrectly assuming the cap is enforced

Tools Used

Manual review

Recommendations

Remove the unused distributionCap related code:

- Delete the `distributionCap` state variable
- Remove the `setDistributionCap()` function
- Remove the `DistributionCapUpdated` event
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge lacks enforcement of both distributionCap and MAX_REWARD_RATE limits

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge lacks enforcement of both distributionCap and MAX_REWARD_RATE limits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.