Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`BaseGauge::setEmission` - Emission value can never be changed

0xnforcer

Summary

The BaseGauge::setEmission function is designed to allow the GaugeController to modify the periodState.emission value. However, due to the structure of the contract and its inheritance, this function is never actually invoked. This results in periodState.emission being permanently set to its initial value from the constructor, preventing any future updates.

Vulnerability Details

The BaseGauge::setEmission function is marked with the onlyController modifier, meaning it can only be called by the GaugeController contract. Similarly, in RWAGauge::setMonthlyEmission and RAACGauge::setWeeklyEmission (which inherits BaseGauge), are the only other functions that can modify periodState.emission, and they are also restricted to the controller.

However, upon reviewing the GaugeController contract, neither BaseGauge::setEmission, RAACGauge::setWeeklyEmission nor RWAGauge::setMonthlyEmission are ever called. This means that once periodState.emission is initialized in the constructor, it is never modified again.

// BaseGauge.sol
function setEmission(uint256 emission) external onlyController {
if (emission > periodState.emission) revert RewardCapExceeded();
periodState.emission = emission;
emit EmissionUpdated(emission);
}
​
// RAACGauge.sol
function setWeeklyEmission(uint256 _weeklyEmission) external onlyController {
periodState.emission = _weeklyEmission;
emit EmissionUpdated(_weeklyEmission);
}
​
// RWAGauge.sol
function setMonthlyEmission(uint256 _monthlyEmission) external onlyController {
periodState.emission = _monthlyEmission;
emit EmissionUpdated(_monthlyEmission);
}

Impact

  • periodState.emission can never be updated after contract deployment.

  • The intended functionality of adjusting emissions dynamically is non-functional.

Tools Used

Manual review

Recommendations

  • Ensure that BaseGauge::setEmission, RAACGauge::setWeeklyEmission and RWAGauge::setMonthlyEmission are properly called within the controller contract.

  • If emissions are meant to be static, consider removing these functions to avoid misleading functionality.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`setWeeklyEmission`, `setBoostParameters`, `setEmission` and `setInitialWeight` cannot be called due to controller access control - not implemented in controller

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.