Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Weight Update in Stake and Withdraw Functions of BaseGauge.sol

Fortis Audits

Summary

The _updateWeights function is responsible for updating the weights required for time-weighted average calculations. However, it is not invoked in the stake and withdraw functions of BaseGauge.sol. This omission may result in outdated or inaccurate weight calculations, leading to potential misalignment in staking rewards distribution.

Vulnerability Details

  • Effect: Since _updateWeights is designed to update the weight for accurate time-weighted average calculations, not calling it after staking or withdrawal could result in stale weight data.

Impact

  • Unfair Reward Distribution: Users may receive either more or fewer rewards than intended.

  • Financial Risk: Users exploiting this oversight could stake or withdraw at optimal times, gaining unfair advantages.

Tools Used

Manual Review

Recommendations

Invoke _updateWeights:
Call _updateWeights with the appropriate weight parameter inside both stake and withdraw functions to ensure weights are updated after every balance change.

function stake(uint256 amount) external nonReentrant updateReward(msg.sender) {
if (amount == 0) revert InvalidAmount();
_totalSupply += amount;
_balances[msg.sender] += amount;
++ _updateWeights(_totalSupply); // Update weights after staking
stakingToken.safeTransferFrom(msg.sender, address(this), amount);
emit Staked(msg.sender, amount);
}
​
function withdraw(uint256 amount) external nonReentrant updateReward(msg.sender) {
if (amount == 0) revert InvalidAmount();
if (_balances[msg.sender] < amount) revert InsufficientBalance();
_totalSupply -= amount;
_balances[msg.sender] -= amount;
++ _updateWeights(_totalSupply); // Update weights after withdrawal
stakingToken.safeTransfer(msg.sender, amount);
emit Withdrawn(msg.sender, amount);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::stake, voteDirection and withdraw don't call _updateWeights, causing outdated time-weighted average calculations that lead to unfair reward distribution

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge::stake, voteDirection and withdraw don't call _updateWeights, causing outdated time-weighted average calculations that lead to unfair reward distribution

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.