Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

When adding a new gauge, typeWeight is set to 0 instead of the stored typeWeight value of the gauge type

0xgremlincat

Summary

In GaugeController.sol, admin can add gauges via addGauge(), whereby the added gauge has to be either RWA or RAAC gauge type. Each gauge type has their own stored typeWeight value that is stored in typeWeights mapping. However in addGauge(), the typeWeight value for the newly added gauge is hardcoded to 0.

Vulnerability Details

function addGauge(
address gauge,
GaugeType gaugeType,
uint256 initialWeight
) external onlyGaugeAdmin {
if (gauges[gauge].lastUpdateTime != 0) revert GaugeAlreadyExists();
if (gaugeType != GaugeType.RWA && gaugeType != GaugeType.RAAC) {
revert InvalidGaugeType();
}
​
// Use minimum weight (1) for period tracking if initialWeight is 0
uint256 periodWeight = initialWeight == 0 ? 1 : initialWeight;
uint256 duration = gaugeType == GaugeType.RWA ? 30 days : 7 days;
​
gauges[gauge] = Gauge({
weight: initialWeight,
typeWeight: 0,
lastUpdateTime: block.timestamp,
gaugeType: gaugeType,
isActive: true,
lastRewardTime: block.timestamp
});

In the above snippet from addGauge(), line 17 shows the hardcoded value of 0 for the new gauge. This typeWeight refers to the weight multipliers for each gauge type.

Now referring to the initializeTypeWeights()function below, it sets the initial typeWeight for RWA and RAAC gauge types.

* @notice Sets initial weights for gauge types
* @dev Evenly splits weight between RWA and RAAC types
*/
function _initializeTypeWeights() private {
typeWeights[GaugeType.RWA] = 5000; // 50%
typeWeights[GaugeType.RAAC] = 5000; // 50%
}
​

Impact

All newly added gauges will not have the correct typeWeight set as defined in the typeWeights[] mapping, and instead will always have typeWeight = 0. There will hence never be any weight multiplier value for all new gauges.

Tools Used

Manual

Recommendations

Ensure that typeWeight retrieves the correct value from typeWeights mapping, depending on the gauge type of the newly added gauge.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::addGauge incorrectly stores initialWeight instead of periodWeight in gauge struct, causing permanent DoS in updatePeriod when initialWeight is zero

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

GaugeController::addGauge incorrectly stores initialWeight instead of periodWeight in gauge struct, causing permanent DoS in updatePeriod when initialWeight is zero

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.